What are common methods of intrusion into a Drupal website?
The first question is how they are uploading and extracting the file. That is likely only possible via a vulnerable contributed module (probably an out of date one) or because they have credentials to your server (either at the drupal layer or the server - ie ssh or sftp layer).

The second question is why your tmp directory is in a publicly accessible location (is it?). If it's not then it seems more likely the problem is arbitrary code execution or credentials compromised.

Solutions: basically you have to "start over."


Audit every single account and permission
Audit every single file of code - download fresh copies from drupal.org and ensure the versions on your site match them exactly.
Install the security review and paranoia modules and read their documentation to ensure they are working properly. They will help audit your permissions and content.