Players on UN have been receiving empty PM's from various different players. We've done some snooping and found that the PM's aren't actually empty, and contain the following HTML code.
<img src="http://surgecraft.org/log.php?a=#a&b=.jpg>
The fact that the php file is named log isn't very comforting. I don't actually know how to tackle the issue apart other than not open your PM's for the time being, which isn't very practical X_X