We had a user enter a viagra ad that actual redirected to their site. I think the offending code was here:

<img src="http://www.google.com/noimage.jpg"onerror="top.location.href='http://www.example.com';" align="absmiddle" border="0" />

(although obviously they didn't use example.com)

I've attached the whole page for examination.