Kieran Healy at Crooked Timber has a thread about this type of attack. He doesn’t have a solution but it sheds a little bit of light. He seems to believe it was a problem with Dreamhost. This makes me wonder if Bluehost has been hacked, or if the hack was a php exploit. (Not that I understand what that means.)
I have to say that this sort of thing, and the time that it’s going to take me to figure out, kind of makes me wonder if it wouldn’t be better to have the blog hosted on something like typepad or wordpress.com so that I could simply refer this to a support tech and have them fix it. Sigh.