Sorry guys I am a total newbie to the security issue. Let me try and explain it better.

On my website I upload all my files through WSFTP and that is why I thought the person had to be doing it from some program like this. However last night I changed the password again but they still got in.

Hope this clears it up.