I think I might have an easier way to find the rogue file.
I modified the previous filter to email me the $_SERVER['HTTP_REFERER']
Hopefully that will lead me to the file
↧
413Critter on "Scheduled Spam Posts keep appearing"
↧