Spam inserted into drafts, not on comments

Hi,

We’ve been running WordPress since v2.7 for about six months now. After every few weeks, existing Posts Drafts suddenly contain links to spam sites. The published Post isn’t affected, but once the Post is loaded in the Admin, it shows the spam links at the very end of the Post. It is almost as if someone logged in as an Administrator and added the links. The links all point to ‘The Florida Center for Instructional Technology’. But it’s all spam.

This is a creepy problem, because it seems as if there is a leak somewhere and someone just injects those links. There are only two Administrators on our team and neither have added these links.

We have removed these links twice before in every Post and Pages, but they always come back eventually. We are looking for a permanent solution to this problem. Is WP not safe?

Hopefully someone can help. I hope this is the right forum to post this in.