WordPress Hack
It turned out that the upgrade did not solve the problem as it was header.php in my theme that was modified to include a <u> element with display:none that included a long list of bad links. (see excerpt at http://www.pastie.org/223173 ).
I assume it happened via sql injection that I hope had been resolved in WordPress 2.5.1
