No real way to prevent them from being uploaded. I've seen them uploaded to any writable directory. It appears they've found some way to exploit one of the scripts that is allowing them to get files uploaded into any directory as long as it's writable by the webserver.
Normally I can track this type of thing down by looking at the timestamp of the uploaded file and comparing it to the access logs to see what script was being accessed at that time, but every one I've worked on today has had their access logs turned off, so no luck.
