So I connected to my server today and found a spam post uploaded to the front page. I just checked. 3 obvious spam users. Oh, shit.

EDIT:
Panic Averted. I thought I'd been hacked (despite running the latest version of drupal, but it wouldn't surprise me that there's vulns that haven't been found by the good guys yet.), but it turned out I'd left authenticated users with the ability to create blog posts. Not quite what I intended, but nowhere near as bad as what I thought.

Spam users blocked, and the spam nuked. We now return you to your scheduled programming.