it's like a prince albert, only more functional

The spam actually said "Pens and Watches", as opposed to "Penis Watches"

convoluted

disk image.
disk image mounted on loop device.
disk image mounted on loop device, exported via NFS.
disk image mounted on loop device, exported via NFS, bind-mounted to an entirely other directory.
Now chroot into that environment.

I really should learn a bit more about building my own initrd images, as it'd cut down on this sort of abuse.

doh

Why, yes, I did in fact manage to upload a page to my website with one of my passwords in plain view. And, thanks to my site's googlejuice, it's already cached, indexed, etc. Fortunately, it's only in use at one public point and I've already changed that.