Are you sure that somebody reverse-engineered it, or is it possible that someone's just got a set of rules generic enough to work on your site? From personal experience (with getting spammed), I suspect it's the latter.
It's always possible. I no longer remember exactly how it worked and why that made me think it had to be reverse engineered. This was many years ago now.
