Traffic to this site was growing fast, according to the AWstats log analyzer. Just what every website owner wants to see. Some comment spam here and there - nothing big, I thought. One day I finally reviewed the comments and realized there were over 10,000 of them - all spam! It took a while to figure out how to delete them all easily (truncate the comments tables).
Not sure how the spammers by-passed the captcha I put in place - there's either an exploit in place or spammers took advantage of the fact that they only needed to solve it once and then could post unlimited comments.