Sorry, I didn't realise it could do that from posting it on a forum! I just wanted to see if anyone might have recognised it and know how to deal with it.
Is this a first for this or has anyone else seen this happen? Is it a security flaw in 6.2 or could someone have hacked my ftp account?

1. More than likely - upgrade to 6.4. These upgrades aren't just 'feature fixes', they patch some of the ongoing security probs too.
2. Yes, very possible too depending on how you run it, strength of passwords, encryption, firewalls etc
Simon

Ok thanks.

Well, I have changed all the login & password details now. I wonder, can I just patch up to 6.4 now and continue to use the manual payment module that I have for the time being?

Dunno - why not set up a test site of your store and try out the payment module there. If anything is going to break / cause problems, it'll be the payment module on an upgrade.

Make sure to check the Extensions area for updated payment modules too.

Simon