That's pretty special - and the whole thing reminds me of a rather more minor snafu with social media a client had. My business built and operated an ecommerce

That's pretty special - and the whole thing reminds me of a rather more minor snafu with social media a client had. My business built and operated an ecommerce platform. At one point we added a feature that would allow retailers to populate content areas with images from twitter and instagram - they'd just pop in a hashtag, images matching that tag would flow into the CMS, and they could then choose which to publish. So far, so good. Users are tweeting product shots, retailers are semi-automatically populating their sites with them. Along comes a client - who is running a very successful campaign with it - but they're struggling to find the time to moderate everything, can we please make it auto-publish. We warn them of the probable abusive outcomes, but they aren't having any of it - they say that they'll reactively moderate. We acquiesce, but only after getting them to sign a release that essentially says "we warned you". It goes live, after having languished in staging for a month where the client adamantly refuses to test it. "We'll test it live, we'll just set a hashtag on the main homepage module, and we'll see it working." We know the change to autopublish has been tiny (a single additional setting toggle) and safe, so aren't too perturbed by this all too usual behaviour this time. Twenty minutes after it launches the client's MD (this is a £100M brand) phones, frothing and panicking that the site had been hacked and was full of porn. A glance at their usually clothing filled homepage reveals an alarming amount of flesh. At this point I'm almost impressed that they've been attacked so quickly, so hop into their CMS to do a bulk delete for them - when I start crying with laughter, for what have they chosen as their test hashtag? Only #xxx.