XSS being used not for any pseudo-1337 purpose such as fraud or identity theft, but for plain old SPAM. This is like breaking into somebody's house and not stealing anything, just slaping your advertizing all over their stuff and getting out.

More details after I've figured out exactly who to complain to.