What do you mean?

I thought the attacker stole the account maliciously, but hadn't quite gotten around to inserting the malware by the time it was taken back.

The live http headers hacking was quite embarrassing for myself personally.

I had strong suspicions that a certain webhost a new client of mine utilized was both prone to attack, and not very forthcoming when past attacks had occurred.

So when I loaded their own website one day and found it full of ads for russian pornography... I confirmed my own bias that the webhost had been hacked... deleted the account, and moved everything over to AWS.

Changed all the passwords, freaked out a bit, etc...

Then I realized that it was just the extension I was running that injected those ads... d'oh!