Curious about recurring post.php hack

I manage a number of WordPress installations and just one of them is continually plagued by the same hacking issue. A file keeps showing up in the root wordpress folder called post.php. It has ownership set the same as my other files, which is www-data:www-data (this is on a debian server). It contains obfuscated PHP code which allows running code from an attacking site. (if you are interested, the code can be seen in this txt file… http://simplemindedme.com/bad-post.txt )

I have changed the password on the wordpress installation as well as my server account. I do not run FTP, only access the site via ssh. I am running wordfence which indicates no issues on the strictest settings. I have run other command line scripts to search for code in image files, again nothing found. I have check all my cron jobs… nothing in there. So my question is, how does this file keep re-appearing?