Some people ruin the fun for everyone else.
Until I can patch the security of the img tag, it's disabled. You can still upload and embed attachments as normal.
Additionally, the exploits that were abused have been patched on PR2.
To anyone who was affected: make sure you go to
this link to delete your token from the PR2 database. You can then log in as normal. This is simply a precautionary measure, since I highly doubt the culprit has anyone's tokens.
As I suspected, the culprit doesn't have anyone's tokens.