Good morning Von.
Ok so I was able to replicate the issue and found out how the user got the <span oncontextmenu="try{event.cancelBubble=true;event.preventDefault();}catch(e){}return false;"> into the signature.
Now it doesn't matter what is typed in the signature. So regular text also has the same issue with scripting showing up. Here's how I replicated the issue:
1. Create a new signature for your account
2. Name it whatever you want
3. In the signature section type in anything. It could be a name, number, whatever it didn't matter what I typed in there
4. After you get something typed in there, click on the ABC button for the spell check
5. Once the middle section is highlighted green, right-click on whatever text you have typed in and select "Ignore All"
6. Click the ABC spell check button again so the screen goes back to regular mode
7. Now click on the <>Source button and you will see <span oncontextmenu="try{event.cancelBubble=true;event.preventDefault();}catch(e){}return false;"> listed in the signature line you right-clicked on
Now here's where things get weird, every line you add into the signature after you did the above procedure continues to add the script on each and every line you add in afterwards. So if you another new entry before you save the signature and click the Source button you will see the script on the next line you added. I even went as far as saving the signature and edited the signature again. I enter a few new lines on text or numbers into the signature and the editor continues to add the <span oncontextmenu="try{event.cancelBubble=true;event.preventDefault();}catch(e){}return false;"> into each new line I add. Even if I spell check the signature again and add something the to ignore list. it still continues to add the script on each new line I add. I verified this through the Source Editor.
So it appears to be a bug in the spell check feature with the Ignore All selection only. If I added something to spell check by clicking on Add or Edit, it never does this. So it would explain why the scripting in my user's signature ended up at the bottom of their signature. They must have clicked the Ignore All on the 3rd last line of the signature and then added other entries afterwards.
Let me know if you need anything else from me. I'll be happy to help.