<A target="_blank" href="http://www.theregister.co.uk/2009/05/21/ball_state_retracts/">First reports from Ball State University</A> said the Internet Information Server vulnerability was the cause. Now that they've had time to catch their breath, they say it was misuse of a user account.