Most of my hosted sites were infected on May 13th. I've got multiple successful FTP logins from different ftp users in my logs. I could imagine that a brute forced password for one (!) ftp account would be possible. But not for that many at once.
May 13 03:48:53 ********* proftpd[13929]...