Drupal 7: Permissions when Apache is running as user account
If you're on a shared host this is to be expected, a lot of them operate like that. 

Most use suEXEC as the Apache PHP handler which is what makes the web user have full read/write rights over the whole document root. Unless you have access to change the Apache PHP handler (or at least its settings) I doubt you'll be able to change this yourself.

Your hosting provider might do it for you if you get in touch with them, but going on past experience they're normally reluctant to change this sort of thing (in the case of a shared server they might not even be able to do it on a site-by-site basis).