Not the first "you've been pwned" message on the Internet and won't be the last.
It just happens to be the first I've seen use Google Analytics to track the lulz with CSS and @font-face. With that layout I was expecting to see a customer rant, not a "pwned" message.
On a more serious note are they going to be able to afford to have a separate EC2 instance per customer to avoid having to write a proper sandbox?