I just thought I’d mention it here, because you don’t say anything about suspicious administrator users, so it’s possible that that’s something you have overlooked. Also, there seems to have been an outbreak of this lately, wordpress.org’s support forums are swarming with people reporting the same symptoms.

I too have been hit by this, on the 2nd Sept 2009.
I’m a bit stunned as like yourself I have no idea how this person has done it. Kudos to the little punk.

I am beginning to think its a WP exploit. I have a part of my website served up from a private area, none of the files there were effected. Everything effected has been in the root wordpress directory. I am using WP 2.6. Maybe time to upgrade.

I’m not saying it’s a bad thing–but it’s a different thing that will require a new level of device hardening than we need today. NAT and the home firewall provide a crutch that is going to go away once IPv6 becomes the norm.

Crew goes back in time
For songs of the humpback whale
Or else Earth goes boom

(also from Scalzi)

I hope you’re having fun in Ireland (it certainly sounds like it from your Twitter stream).