Thanks everyone for the facebook feedback. Indeed this did happen and begin after Oct 26th. I believe our registration began closer to Nov 1st. It's relieving that this appears to be coincidence and is not a local virus, keylogger, undetected VPS break in, etc. My spamassassin is set up as a pretty generic install, although I do edit the config to add rules. I do not necessarily need to focus intensly on spam elimination, I am pretty much my only customer. Thank you for the help.
