Hi Nick, thanks.
Having exhausted all other options, I wanted to rule out all modules with mass mailing capabilities. I can now exclude CB, which is in fact installed on the system. A hack seems unlikely as it is a straightforward corporate website built properly, but I am not a developer so I can't tell. Thanks anyway.