Looking into this more I see myftpupload.com is an access domain in use by GoDaddy - some background here - What is myftpupload.com? myftpupload.com belongs to...
Question is how on earth did my Piwik website config change to it without me doing it. And how is the spam access domain inheriting a lot of the same content and all the styling of the real website.