Directory permissions question

I'm working on a hosted website that was hacked and found something I don't fully understand. Thought someone here may know the answer. The site has 4 php malicious files in directories owned by "system" [php created dirs on the site are named "nobody"] and permissions 755. Is there any way the files could have been written other than by ftp access or at the host root level? Clearly a php script couldn't. Thanks, Al..........