If it's the same thing as
what the CBL went through awhile ago, I don't think it's some fellow OOTPer. I think it's something any website with similar security holes might suffer. I never did figure out exactly how they were doing it (we ended up just going to a bare bones site for a little while), but I did find out that it wasn't limited to OOTP online leagues. Mind giving us more info, maybe a link to a thread on your board talking about it, so I can look into it further?