Worms knowing the passwords

I got one of the sites in my care hacked. The index page was changed, an iframe linking to a third party server hosting some exploits was inserted.

Examination of the logs shown a login via FTP, download of the file and immediate reupload. That was done couple more times, from vastly different locations, over a period of few weeks. There were no signs of bruteforcing, and the password was reasonably strong.

The hypothesis is that the computer of the person responsible for the site content was wormed, the worm took hold of the site/username/password saved there, and then told its brothers in the botnet.