Someone has added an apparently malicious JavaScript to my home page. Is there any way they could have done this, besides cracking my FTP site user name and password? ...