This site was hacked twice in the past couple weeks (or just once and I never fully cleaned up the mess the first time). Either way, it's my fault for using the same ancient version of wordpress for years. Fortunately the hacker seemed to be only using this domain to send Halloween themed Viagra spam. Heh.
So I've rushed an upgrade and will stay at the default Wordpress 3 theme... for now.