Duncs,

From my point of view this looks like a (fairly simple) SQL injection or a Cross Site Scripting attack, which uses the "login.php" page on your site. This is a web attack that is easily preventable. However, it could be a server side issue - that is more serious.

I will run the entire domain through my scanners tomorrow; if I find anything vulnerable that could have caused the attack I will let you know.

Just trying to help!