I had a WP install on a site which I had played with but then ignored, so not updated.
Lesson for the future. Do not leave any interactive things (i.e. stuff you can login to, stuff you can comment on etc) unattended or without updates on the internet.
I helped someone host a website once. Part of that website was a forum. The forum idea never really took off, but was left there growing cobwebs "just incase". Lesson learnt the hard way when I received a phone call one morning from officialdom asking why links to kiddie stuff was found.
Turns out the abandoned forum had been taken over by undesirables.