We seem to have been found by a spammer. I removed the messages and put some blocks in place, including a better captcha. The messages have been removed, but anyone with email notifications and/or RSS feeds had a bunch of junk.
Hopefully nothing more extensive will need to be done to stop additional spam.
Nathan