This is probably a site hack so our coder will look at it. It's happened before, one of the plugins is vulnerable - the coder cleans the infected files then patches it. We regularly get a report like this from one or two people, and in that case it's a local problem for them - but when it's hundreds, like now, then we have to look at the site. It has happened, once before.