Just to wrap things up - it was apparently an SQL injection attack.