bah, @jongalloway jinxed me. one of my personal wordpress blogs got iframe hacked. Sigh. 3.1.2 wasn't up to date enough?