My humble theory is that the hijackers are using known BL players' IP addresses, then checking periodically for open ports on their computer. The victims are either always logged in to the forums, or they have weak passwords which are easy to guess. The hijacker uses these ports to post stuff on the BL forums.