McB. are you running and maintaining the webserver yourself ?
Windows or Linux ?
ISS or Apache or ?
Do you have your webserver set to log the following:
error_log
access_log
I would be interested to have a look at them and see if there are any direct signs of intrusion from that particualr day where it happened.
Im sure that
abuse@ISP.dk and
abuse@CERT.dk would akso like to look at those logs if they contain any valuable information