Well, that's what I get for being a lazy boy.
I didn't update from Wordpress 2.5 to 2.5.1 - something else kept coming up - and I think the site got compromised (thanks to my sister for alerting me). So I've spent this morning building an entirely new webserver VM and importing my posts from the old one to the new one. I decided not to transfer the user database, in case it was still compromised in some way. So you all don't exist any more: if you want to comment, you'll have to re-subscribe. Sorry!
I did get to clean the server up a bit, though. I'm now using packaged Wordpress, which should make it easier to update.