Oh, yes, I definitely have backups and restoring is not an issue. The big thing for me at this point is identifying the culprit. Maybe it's just a huge stretch of the imagination, but I was thinking that grepping on the server (or something along those lines) might reveal an IP address.