Do you have any other scripts installed on the server? It's more than likely they got hacked and he just defaced the more popular areas of your site (to take suspicion away from how he got in so he can do it again).
Other possibilities are that he guessed an admin password and logged in and edited a template...
