Doing my regular backups of the blog, I noticed that the size of the db had tripled over the last week. After some sleuthing, Greg and I discovered that we've been heavily hammered from an IP in Spain (193.144.251.31), which we presume must be a compromised server; it appears to be trying to comment on everything, and although comments are blocked so it's not succeeding, it's still filled up the hitlog and sessions tables, so we cleared those out. That brought the db down to half the size it was a couple of weeks ago. We've set up a cron job to do that every night.