The site was defaced this morning. After much investigation I can find no point of entry on my site. The working theory is that another site on my shared server was compromised and used to access my site. This theory is supported by the experience of my coworker with current hacking trends, and my case fits the profile. They apparently had direct access to my database. There doesn't appear to be any permanent damage but they probably had access to user profiles (emails, icqs, etc). I don't think my forum information was their target. This appears to be just a drive-by defacing.