The answer to most of which is "I dunno".

I can at least confess that I deleted the spam comment. That much can be determined with certainty. I can say with less certainty that it didn't struck me as anything except spam.

I did wonder how it could happen, since WordPress is configured to allow only logged-in users to post comments. But WordPress being WordPress, all it had to say for itself was "I dunno". It offers a multitude of avenues to hackers, including things like RSS and email posting that people often forget are even there; and are only erratically covered by WP's access control. So maybe somebody exploited some esoteric hack.

I'm not going to sweat how somebody penetrated this creaky old site. We're close enough to the new site now to let it slide. Next installation will start out locked-down and clean, with some of my own stuff in the background to keep it secure. This sort of thing should be less of a problem.