tamagothi

I just password-protected the whole wp-admin directory with HTTP auth, which should prevent this kind of attack. It may help in other cases of strange defacement attacks too.