You need to perform an incident response, you can hire a firm like Trustwave, but my guess if you don't have the funds for such a large investment.
Since you are using a popular open CMS system, its going to be a target of attack. It is also built upon other open source components, so those may be affected. Of course, there are a number of other vulnerabilities that are possible given any number of third party, built-in, or home brew components. You can find a list of recent exploits and bugs at the NIST CVE database listing of Typo3 Vulns.
There are a few things that could be resulting in a massive infection that seems indiscriminate. If the permissions of the files and directories are not set correctly, or if the file and directory ownership is misconfigured this could be the first problem. There may also be some script or piece of software which is vulnerable and has the ability to execute arbitrary code, and thus can write and append any files it finds. If it has the ability to arbitrarily execute shell commands, then its easy to search for all php file and inject the code with a few lines of code.
Another possibility might be a flaw in another tool you are using, maybe a web-based management console for hosting or a helper application like phpMyAdmin or some other random code is vulnerable.
At any rate, the first place to start your investigation is by reviewing the activity logs. I'd start with your ssh access logs to determine if anyone logged in directly when you do not think you did. Next, you should look at your server access logs. If there is a flaw in some web application, they probably had to issue a command against your page. They may have googled for a certain common HTML source string in google and the target all sites they found broadly. Is so, they are probably re-running their attack every so often to reinfect you if you didn't find the hole. Look for log entries that seem to have SQL injection or XSS. This could be labor intensive process, but if you think you know the timeframe of when you got hit, that should help limit your search.
Another check is that you have removed any installation or other files they recommend you remove that could allow an attacker to reset defaults, etc. Also, be sure you are using strong, unique passwords. After an attack, I would always recommend changing your passwords as a precaution.
Lastly, there are often clues in the exploit code itself. Did they infect it to redirect to a certain site, do they have "greetz", or anything else that you may be able to google and find someone else talking about on a forum? Unless the attack is against your custom code, its likely someone else got hit in a similar way as well.