Our server was attacked today by a spam bot sending user messages (yes very ironic).
The user and their ip have been blocked, and the spam messages deleted. Sorry if you were sent email from the messages.

Just a note on how to correctly use the web API.

When you use the web API ensure that you pass your application id. An app id is free, and you can easily get one from your user page. You need to pass your app id on every request.