Same problem
A 'customer' added a sub domain and the screen which says..
'The subdomain, barf.domain.com has been added.
then printed out EVERY user on the box like so...
(/home/poipu4/etc/passwd)...Done
Updating mas56 ...passwd,v --& passwd
revision 1.2
done
(/home/mas56/etc/passwd)...Done
Updating mark ...passwd,v --& passwd
revision 1.15
done
(/home/mark/etc/passwd)...Done
Updating patco ...passwd,v --& passwd
revision 1.19
done
(/home/patco/etc/passwd)...Done
Updating caw100 ...passwd,v --& passwd
revision 1.1
done
+
+
+
etc ..
What happened here?? I have received my first ransom note... :p