In reply to Howdy_McGee.

Actually this specific problem (if I understood it right) could have been easily mitigated by blocking in .htaccess the direct execution of php files that are not in root directory. At the min it will force the evil people to write their backdoors fully according to the best WP developement standards :)