How can a domain parked at Godaddy be hacked with Wordpress?

So a partner of mine had this domain from the 1990's. It's a good domain, but he wasn't doing anything with it.

So it was parked at Godaddy for years.

Finally he agreed to sell it to me. I paid a hefty amount but I know this domain from the start (I was the first devel for his company 20+ years ago).

So I add it to GWT and guess what. Manual penalty! I said what!!!

Then I check archive.org and the damn thing was 100% spam.

I checked DNS history and it was parked at Godaddy, under xxx.domaincontrol.com DNS servers all this time.

Anyone else seen this? This is news to me. I can tell the hacked pages are Wordpress. How can a parked domain get Wordpress installed and be filled with shit? Is Godaddy parking itself hacked?

Man I haven't worked with GD for 5 years I think now....and this case has blown me away. Anyone know how this is possible?

Bumping for interest

This is nothing new sadly! I buy domains all the time and park them till I got resources to blow up the BH moon. I've lost 7 FIFA World Cup 2014 domains this way. So, my parked ws was part of a huge spammy company from Italy. All WP but 1... Joomla.

GD still don't give me a reason. GD never more.

Can't really reply to your answer but I saw something weird with godaddy's domain control panel this week.
I have a domain name that was pointing to my old server via A record last year (and since i bought it) ...
As I wasn't planning to use it anymore, i decided to redirect the domain to a cpa offer using their redirect service ...
The NON www version is landing on the cpa offer as it should but the WWW is still pointing to my server IP (A records where deleted) and i can't get rid of that ...
I don't know if your issue could be similar but this might be a hint

Funny that I posted about them buying Sucuri, only yesterday.

https://www.blackhatworld.com/seo/godaddy-acquires-sucuri-to-boost-wordpress-security.926028/#post-9873883

With a webshell ??

https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/

Or...

http://resources.infosecinstitute.com/hacking-a-wordpress-site/#gref

One of my PBN site (hosted by Godaddy) got hacked before because I was using an obsolete plugin...

Sucuri will continue its normal business operations, while GoDaddy will extend Sucuri’s security services to its customers. Financial terms of the deal were not disclosed.

Click to expand...

This means godaddy gets access to your hosting even you are not a customer of GD.

Here are some ideas may help:
+ The owner could add it to blogger with www or sub domain, then spam
+ The owner spam backlink to get traffic to his parking site
I just guess

Well, ask you friend about that, buddy. No parked domain could change the DNS itself or no Godaddy would be stupid to use the parked domain for some spamming.