Dont suspect any one source. Somewhere along the way, there may have been someone that put the forums on the radar, but once youre in these type of malware databases they just keep coming after you.
I have been chasing ghosts in the server settings for weeks and am embarrassed to admit that i neglected to look for patterns in my access logs.

server tech 101... but at least I take comfort that the contractors didnt find it either...

Anyway, I think I may finally be on top of it.
We will see.