When you go to delete the account on a fully patched store you are prevented from doing so by returning invalid form key and the account must be deleted from the Manage Customer Grid.
Had this same issue. For whatever reason the payment failed and order was not created. Will follow up if it happens. we are fully patched on Magento 1.9 latest version.
We just had the same exact hack on a customer site. We were fully patched up to the latest version. Does anyone have any information about this hack? There seems to be some vulnerability in Magento.
Can you confirm if that value is stored into the database as html entities?