I did get thanks over e-mail from Julia and Alex when I reported this in.

I like to think this was an automated exploit, but given that it rolled in on Sunday (which is when staff is rarely around here), and given that this site runs on proprietary software, it may also be a targeted exploit attempt.