How this happened?
Your web site (whatever contents it runs) was hacked, someone used it to upload and run a trojan to your server. How exactly it was hacked depends on the site itself, could be a bug, a vulnerability, a too-simple password... anything, really.
How an AppPool can write a file to disk outside its root directory?
This depends on the user ...