This is ridiculous. A coworker installed your plugin after they're blog was hacked. And believe it or not, I've spent more time removing what this plugin left behind, than what the hackers did.
And if you wondering... No, the plugin didn't find a thing. I did though.