I do believe I have a plugin that does something like that. That I totally forgot about.
I'll have to poke around and see now. I reacted to someone in irc saying "your site has been exploited" and this being right in the midst of the server going up and down so much the last two days, it should be named Otis instead of Lilwowe or whatever it's called.
'cause no amount of Google-fu brought me any results, and if it was some kind of WordPress exploit I'd figure I'd have to find something similar. Of course, not searching for the hash like stuff.