Yeah, the x-header info is showing it coming out of register.php, but I'm not able to decipher if that script is being called through an external PHP hack or not...

Quote
Subject: New user registration at mydomain.com
X-PHP-Script: mydomain.com/site/modules/profile/register.php for 182.189.149.33
Date: Fri, 29 Mar 2013 05:53:44 -0500
From: =?utf-8?B?bWF0dHJlaW5mZWxkdC5jb20=?= <[email protected]>
Message-ID: <[email protected]>

I'll keep poking at it. Thanks!

--------------
Matt Reinfeldt