wordpress.com is pwned!
… is the only explanation I can see.
My last post “is it blog spam” appeared as “private” when I first hit the “publish” button. Before I’d even made it public, two comments had appeared. They were trackbacks that were definitely and unambiguously spam.
That must surely have come from within!