Also, (I forgot to mention) changing the permissions of a file to anything won't protect you from that kind of attack, since your user account can always change the permissions of your own files; if someone can execute shell ("command line") code, they can just chmod the relevant files to what they want first.
The best way to protect yourself from this kind of thing is, obviously, to use high quality scripts. You can also run scripts with lower priviledges than your own, if you're still worried. Unfortunately, you need to be able to create new user accounts on the server and edit the server config to do that, and most service providers wont allow you to do that with a basic hosting package.
You have checked the obvious right? that your FTP or control panel password hasn't been leaked/stolen/hacked? You should be able to check FTP access logs (look for unknown IPs logging in as you). But, you may only be able to get access to the logs by asking your hosting provider for them, since they'd be global logs (for all customers).