Turns out there’s a nasty exploit in WordPress 2.3.3 – which if you don’t have it installed people can get into your control panel. You can read more about it …