I talked with GoDaddy who assured me it wasn't their servers, that it was WP. Yet, every php file on my (old) hosting account w/ them was hacked, WP and non-WP files. The WP install on there was the latest version and I have such complicated passwords even I can't remember them.

The kicker? Got hacked 5/7/10, cleaned up everything (including a fresh install of WP), changed all passwords (including ftp passwords), and got hacked again today at 4:30 central time!

Sure GoDaddy, it's not your servers at all...

Just one more reason I moved to MT.