It may be something called SQL Injection. From what I understand, if
you have a text box on your ASP page, then someone may be able to type
in a SQL statement and affect your database that way. I don't really
know how it would work, but I bet if you google it, you'd find plenty
about it. Of course, that may not be what is happening at all. :)
Something to consider.