contentsynergy - 4:37 pm on May 23, 2011 (gmt 0)
I was recently involved in cleaning up several sites on a hacked server - and much to my surprise I found the canonical tag hacked in just this manner. It was a Joomla site, and the actual Joomla template had been modified by the hacker.
The only way I noticed it was that I had a FireFox plugin (SearchStatus) that I was experimenting with. It places a "C" icon in the location (right next to the RSS icon) and I'd never noticed it before. I clicked on it a was taken to the hacker's spam site.