To answer your question about "how somebody can write new files into my hosts" there are three ways I've seen this happen.
First, FTP account hijacking. The worst case I had to deal with on my sites is when a hacker gained access to either a root level or high level account that allowed them to overwrite the index pages of all of the sites on that shared host server. Brute force attacks, botnets and other such techniques are how they pull this off. Once they're in they can do whatever they want.
The second, which is also FTP related, is leaving a public anonymous FTP area open with full privileges. This allows the hacker to upload a script and execute it. The script could then copy files or perform other kinds of mischief. Typically they'll delete the files after the run so you won't see the evidence. Some hosts are bad about not locking down anonymous FTP access so always check for yourself.
The last I've had to deal with is SQL injection on WordPress sites. In this case, the hacker uses injection to gain access to the WordPress admin panel and then replaces the active theme with their hacked version. There are various things you can do to lock down WordPress installs better than they are by default. Look around and find one that fits well with your needs.