I got an email like this:
Details: Your site is hacked lock hear (mafiaradio.is-a-chef.net) Resolved:
(18.104.22.168)and lock hear http://mafiaradio.is-a-chef.net:8000/ u will
see your site is hacked ! clean your root and change your users password !!
I checked the url and it was indeed our site - I made some changes to our copy and the changes applied to the "hack site".
Is it possible he just used Curl to create this clone homepage? What is the most likely option?