[dwj]

I think the customer got hacked some other way, and the hacker just wrote to the .htaccess file AFTER hacking the site. Probably the .htaccess is a quick and easy way of taking over the website.