And every WordPress plug-in makes it as dumb as a bag of squirrels with hammers. (How can a frigging theme be a security risk?)
It happens.
I checked and found the nofollows on a number of pages, reported it. Never did hear how it happened. Embarrassing. And the technical person for the site is no dummy.