Yeah. Twitter also has this security hole where you can try repeatedly to access an account as long as you have different IP addresses; it won't stop you unless you're retrying on the same address, and that makes it easier to use those programs.

Anyways, I've changed the password on that, and the spam stopped.