The answer has to do with pi-backbonding.
In essence, the CO molecule has a negative formal charge on the carbon (it's neutral because of the oxygen having a positive formal charge). However, C is quite electropositive, and would like to relieve the stress caused by the negative formal charge. To relieve the stress caused by the negative charge, the CO molecule will want to bond to the iron.
How it does this is related to CO's molecular orbitals, which look like:
Note that the 4, 5, and 6 sigma orbitals, as well as the 2 pi orbital, are all antibonding. I will denote them with * from now on.
As CO stands right now, it has a bond order of three (the two lower sigmas cancel each other out, since 4* is antibonding while 3 is bonding). None of its orbitals, as they stand, can participate in bonding.
However, because carbon wants to rid itself of the negative charge, CO will do an interesting trick. It will promote an electron from the 5 sigma orbital into 2* pi. This reduces the bond order of CO from three to two, and introduces a separation of an electron pair. The picture of the 2* pi orbital is shown here, on the top:
So how is this more stable? In isolation, it is not. However, remember, we are not operating in isolation: there's an iron nearby. Most saliently, the iron has a d orbital, which looks like:
Now, the iron can put an electron into this d orbital and bond it with the pi* star orbital on the CO on the carbon end. This is hugely stable (note that we were willing to promote an electron into an unoccupied orbital and break up an electron pair to do it), especially since it relieves charge stress to do it (as opposed to molecular oxygen, which does no such thing). This backbonding is also why cyanide will stable itself onto iron.
Why isn't hemoglobin designed to bind oxygen as strongly as possible, then? Surely it would seem this would be an advantage, evolutionarily, if oxygen could bind tightly and never let go? But oxygen needs to let go: hemoglobin is a transport protein, and it needs to release oxygen into the tissues. That's why you have plenty of things that bond hemes more tightly than molecular oxygen: we need $\ce{O_2}$ in our tissues, not locked into hemoglobin forever.
EDIT: The hybridization of the iron in the protein is often (but incorrectly) assigned as $\ce{sp^3d^2}$. This is implied by the octahedral geometry the ligands around the iron take: the heme consists of an iron bound in four coordination sites by a porphyrin ring, one site by a histidine, and the last site by the oxygen the iron needs to bind.
The formula:
$\ce{Fe(II) + CO -> Fe(III)CO}$