Could be suspicious.
It comes from:
198.251.81.170

which have a reverse of:
node-198-251-81-170.reverse.x4b.me

However, noticed that bitcointalk.org does resove to 198.251.81.170 too.
This could mean that the attacker still have Control of the server (?)

Perhaps he installed a backdoor... And he want everyone to change passwords, so they Think they're safe now, but he simply capture the new passwords.