How is my website infected?
There really isn't a lot to go on here.  You really need to try to match up the ctime (creation timestamp) on the malicious files with the Apache logs to see what may have happened.

Other than that, you should


Take a backup.
Do a yum update on your server to make sure you have all relevant patches.
Clean out your temp folders on the server, and reboot it.
Bring Drupal core up to date.  You are several versions behind, and have other security vulnerabilities.
Bring your contrib modules up to date.
Double check all permissions that may involve PHP input, like the PHP input filter, block visibility rules, view rules, etc.  To be honest, I would disable the PHP input filter altogether.
Audit your custom code to see if there are any problems.