Hi Kevin. It looks like you could use Declude Hijack. It's a free program that we offer. It prevents this type of thing. Hijack along with throttling in SM and SM's internal spammer notification work really well. If you would like me to take a look at your server, get Hijack installed and stop the current compromise, I will be happy to do it free of charge. We normally charge at least $75 for this service, but I will be happy to give you a hand because I know how frustrating this can be. Please contact me at my email address if you are interested in the help. Thanks!