Compromised Site

[Tsi-Shawn]

I have a domain on my server that has been compromised. It is contained to itself and has not affected any other part of the server. All scripting has been disallowed for the domain so the only thing happening is that files are being uploaded to the domain, they are not being run. My confusion lies in where they are being uploaded though. The uploaded files are being placed in the root directory outside of httpdocs. Anyone have any insight on how this is possible?

I guess this is a part two to my other post concerning domain permissions. How do they have permission to place files outside of httpdocs and how do we lock that down.