The sad thing is, even people who ought not be amateurs, but are, fall for this trick. My mother's company's site was hosted on GoDaddy (I offered to move it and pay for the hosting as it's a non-profit, but she declined). They swore up and down for weeks and weeks that they were not responsible and there was nothing wrong when it was a hosted Wordpress instance.

Most of the time they (hackers, sorry pronoun overload) just naively check the referrer. Going to Google and searching for the site and clicking it is often sufficient