Some dickhead spammed
paulduncan.org. The thing is, my backend is custom, so either someone took the time to sift through my source code (unlikely), or there's a spam bot out there that's smart about posting comments.
Either way, I added a ban list to the page, so the problem is fixed now. Everyone should add the IP address
220.127.116.11 to their ban lists.