Site running 3.1.1 hacked

My community news site was hacked in the last couple of days, after I’d upgraded to WP 3.1.1. I have Bad Behavior and Limit Login Attempts plugins running, but I found a link to the following site appended to the footer this morning: https://www.gftforextrading.com/

I also found a new admin user named “rhino” with a fake email address.

Any thoughts on what might have happened? I’ve checked several other sites I manage and have found no problems yet.