It looks like other people are going into lots of details, however the single biggest source of malicous activity has to be FTP.
Lock it down to certain IPs, disable it for accounts that don't need it. Even disable service unless it's requested.
I've had to deal with dozens of hacks after malicious code is uploaded into websites, either spamming the world or redirecting visitors with iframe injections. Rarely do they get root or shell access, instead they just cause a ton of manual housekeeping work of un-blacklisting servers and manually searching code.
The main source of the hack isn't the server itself, but infected end-user PCs which sniff FTP passwords and send them back to the mothership, to then be used later from a different machine to upload the code.