ok .. if you click the manage link next to the domain name, select the Domain Settings link and the back ups option. You can see the oldest back up has the same URL forwards... so more than likely the URL the domain is being forwarded to has been hacked.