topr8 - 5:22 pm on May 21, 2013 (gmt 0)
i figured it was probably an infection at the host level, but the host was adamant it wasn't them - no knowing if that is true or not though.
i advised them to move hosts anyway just in case, seemed the obvious thing to do.
it made me glad of my own set up! dedicated server, and a hardware firewall which only allows ftp, ssh and any admin page access from my own ip address.