tedster - 9:44 pm on Oct 9, 2009 (gmt 0)

The hijacked .edu pages I've seen this year were served from major university servers, not someone's dorm room or home. And yes, sometimes a server hack also involves cloaking for googlebot - the site owner can have a devil of a time understanding why their rankings fell through the floor. Or, in some cases, the student pages are no longer maintained - they're just sitting there like over-ripe fruit that didn't fall off the branch.