I'm no expert, but right now, it appears that they gained root through something in chruser's mmofps.com site, which I've suspended for now.