Just out of curiousity, when did that supposed attack on splashhost actually occur?

This post in their forums shows that they were aware of insecure demo accounts on Feb 11.

http://www.splashhost.com/phpBB2/viewtopic.php?t=59

Though Alan would be able to answer better, far as I understood it, it was multiple attacks, multiple servers, on-going and the method was a bit hard to easily pin point and track. Once you know what you are looking for it becomes easier, but I don't think this was the case from the beginning. As I said, this is just what I got out of the whole mess, and from posts on the forum (which may or may not be related). Suppose you should just hear it from the horse's mouth...