[fum1n]

They could have been uploaded by using a Local File Inclusion (LFI) exploit , this is where basically a user embeds $wget someshell.php in the exif data of an image, uploads it and then opens the url on a vulnerable script ( I believe vBA Portal is vulnerable to this type of attack )

The files you found where most likely PHP RATs, basically gives the user who opens them in there browser, pretty much full access to your accounts directory and possibly the /home/ directory + other accounts on server if they aren't CHMODed correctly. You can install a server sided anti virus what will automatically detect and delete shells like that or alternately implement an Apache script like mod_security.

Want to find out who did it and how, you should check your raw access logs and do a CTRL+F and enter any of them .php files, then get the IP what accessed them and look what other pages they accessed, most likely you will find there exploit.