I've actually seen things like this happen on my own passworded server and I was stupid enough to tell Badspot about the "hacker" through his tech support email address. I would show the emails to prove it, but my old email address doesn't exist anymore.