Intrusion incident analysis is never easy, in particular if you haven't followed standard procedure for recovery (take physical server off-line, grab a sector image of all file systems it has access to, rebuild machine completely from install media, restore data).
Typically, you would review all the logs files fist, starting with the Apache logs. The most likely attack vector is, in your case, drupal but it's by no mean the only possible one so all logs should be checked (I mean ALL logs). Depending on the file system you're using, additional steps can be taken to identify what activity took place at the time of infection and figuring out both the attack vector used and what was done.
Meanwhile, check all the software your machine is running and make sure it's all up to date. That includes all your drupal modules, themes, etc. I'd also check any custom code with a comb.
Edit: I forgot to mention the fact that, in your case and since you apparently don't have the relevant expertise in house, you might want to consider contracting the incident to a security company that does forensic analysis: it might be a bit on the expensive side, but you'll get clear answers about what happened and how to prevent it.