Hacking Questions – Need to prevent hackers

I have quite a bit of WordPress sites running on 2.51 and 2.61 using 3-4 very popular most up to date plugins (askimet, all-in-one-seo, etc.). I’m not using any plugins that has known exploits.

Anyways.. lately I’m getting hacked by two ways.

1) They insert redirection meta tag on the POST Title. (ex. <meta http-equiv=”refresh” content=”1;URL=http://site.mynet.com/bghfdr/”>)

If they are able to change the post title to their META URL, Usually/Generally, what/how did they access my sites?
Is it hacked via the the database/phpmyadmin or the FTP?

2) They were able to delete files (images) on the server and were able to delete PAGES? Usually/Generally, what/how did they access my sites?
Is it hacked via the the database/phpmyadmin or the FTP?

All my sites are running on latest (2.6.2) or almost latest version (2.5.1) with only few popular plugins.

Generally, what are the most common methods hacker use to hack a site? I’m running on a dedicated server with a fairly respected fully managed server management team.

Thanks,
Mike