Today Hostgator have been migrating to new hardware. Anyone who has a shared hostgator server needs to check their emails ASAP. They have moved everything over, but in the process of doing this, they have also restored all your deleted addon domains and FTP accounts associated with them. Thats right, they have restored all your old FTP accounts. So when that guy did that thing on your server 4 months ago and you deleted the temp FTP account you made for it... Well, he has access again. Check your servers.