The hacker really only needs to be slightly smarter than whoever wrote that bad PHP in the first place. It's not implausible really that they'd send it through the same address.