From your update I'd guess that PHP fusion is the problem here. It looks like there's wide range of vulnerabilites for newer versions than that including SQL Injection and other pretty high risk stuff (sample info here), so it's reasonable to assume that the one you're using is vulnerable too...
So it would be likely that your attackers have got access to your server that way with at least the privileges of the web server user.
At this point really you need to look at rebuilding the server as it's very hard to effectively clean someone off your system without knowing exactly what they've done (e.g. put rootkits on the system)
If you have backups from before the problem started you could work from that, although it could be tricky to tell exactly when they got access.
Key point would be to ensure that you have fully updated versions of all the software you use and make sure to keep the CMS updated as they can be common points of attack.
Also looks like there's some advice on the php fusion pages (here) on recovering from this kind of attack