The only way I know that someone can do that with the permissions set to 777 is that the server it self allows Anonymous log in to the server to the web site. If you have Anonymous users accessing your folders via FTP or Windows Explorer then you need to change your sites FTP settings to not allow any Anonymous logins to the server.