I moved to a new server recently, a week later a site got hacked, all they did was change the index.php file of the current enabled theme, no big deal. I did have a few security precautions in place, no admin user name, all latest versions, no timthumb issue, .htaccess security etc.
I dont want this to happen again, what I did notice is when logged into my WP admin I can edit the permalinks, or any file within the editor (I tested editing the index.php) and it will save.
On my last two servers, I had to go into the FTP set the permissions of the files to 755 or 777 before making any changes, then put them back to 644.
They are currently set to 644 but I can fully edit them within the admin, do you think this is my problem? Kinda worries me.