if you are the only person who has access to the blogs, then the uploader is on your computer. What it is doing is automatically altering your files locally, and using your FTP client to update the files w/o you doing anything. So changing the ftp password doesnt work because the next time you log in to ftp, it just re-records the new password.
Get yourself a good antivirus and scan locally.
My boss had the same issue and all his websites got the same kind of bug.