No hacking here, just a simple misconfiguration in our Rails app. Nothing to see here, move along. ;)
Like many software bugs, it was an edge case that we didn't foresee, but that happened extremely rarely. We've been running Varnish for the better part of a year, millions upon millions of requests and this was the first time something like this has ever happened.
Of course, none of that wipes the egg off of our face. ;)
=P