You can not upload a php file through our application nor would they appear in every last directory the same files over and over. Over the years here I know you have a vbulletin mod which has a security issue and causing files to be uploaded to any directory it can find on the server which is uploadable to. Like years ago Michael had the same exact issue you had and he researched his issue and found it was some flashchat mod he was using on his site for vbulletin.
Basically you need to find out where your security hole is. We know its not Photopost. We typecast all variables for security and there is even code in our application that only allows image files to be uploaded so you can not rename some php file to an image name and upload or even upload a straight php file. You can try and see what I mean.
There is one common denominator with the few people who have reported this issue over the years. They all run vbulletin and they all have various vbulletin mods installed.