I've had two in the past three weeks.

One of them created multiple accounts from various AOL accounts. I caught it after they had created 9 accounts over 2 weeks... But no postings yet. I banned the IP. Thankfully they used the same IP for each account.

The second one occurred today. Someone came in and posted using another person's profile. I saw that it was a different IP from the original person. I banned that IP.

And idea how the second one occurred?

Would it be safe to assume that they got in thru the MySQL database?

Well, in order to get in through the DB, they'd have to first have access to it, and then crack the password. So, that wouldn't be my first thought.

It could be something as the user in question had an easy password or possibly their information was compromised. Probably need to look through the access logs to see what all the IP in question was doing to get an idea.

lots of the recent aol registrations are from African, aol gives them a US ip number when they log on using old aol over internet software.

First thing I would do is contact the member on record and request them to change their password.
Might want to ask them if they shared there password with anyone and tell them that other ip in question was banned.

My 2 cents:
Just arbitrarily banning a IP may ban other legit members.
Since IP numbers can be shared.
I know with my isp the ip used changed every couple of months. But in the last year it has remained the same.

AOL used to (I'm not sure if they still do it) push members through on proxy servers, so whereby you think you're hitting one person, you're likely hitting multiples... Not to mention, AOL doesn't divy static IP addresses, so a user ip will change when they disconnect and reconnect.

seems to me AOL only has something like 5 ip numbers..

AOL is sooooo 1998

Man I hate when people try to hack your site. Don't they have anything else better to do. Sorry to hear you were hacked.