My blog first got penalized by stopbadware.org because it had hidden spam which was injected into it. I updated WP to 2.3, removed the injection, updated passwords and submitted a re-consideration. My site came out of penalty.
On 4th April, I got an email from Google saying that your site is being removed because it has hidden spam in it. I checked and the same WP blog had the spam. I again updated wp, changed passwords, remove the spam manually but it keeps coming back. I have no idea how to get rid of this