The post I added above is actually from what you have on x10hosting:
Code:
<body>
<script type="text/javascript"><!--
var _gaq = _gaq || [];
_gaq.push(
['_setAccount', 'UA-1806325-2'],
['_trackPageview']
);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
//-->
</script>
<img src="http://www.dhl.com.bs/img/meta/dhl_logo.gif">
<div>
<br>
<b>Dear Sir/Madam,</b>
<br><br>
Unfortunately we were not able to deliver postal package you sent last week in time because the recipient's address is not correct.
<br><br>
<b>
Please print out the invoice copy attached and collect the package at our office.
<br><br>
DHL International
<br>
</b>
</div>
<p>
<font color=" #FFFFFF" size="-1">
IT Life Cycle Management: We specialize in data-erasure and refurbishing. We sell End of Lease products on to the second hand computer broker market
</font>
</p>
</body>
That's d1.html; mb.php is what's reading from the 2 major lists of emails and firing them off.
The problem is it was definitely being used; no idea how it got there, but it's definitely on there.
