Do you think 10's of thousands of IIS servers would all be suffering the same fate if it were an IIS issue?

DNN has been through numerous security reviews, both internally and from 3rd party security companies and we have worked hard to ensure that we are as secure as possible.  There are any number of reasons why a DNN site can get hacked including: misconfigured OS, DB, WebServer, DNN or router.  Without specific details and analysis of any given attack, we should refrain from placing blame on any one component.  It was not that long ago that a user posted a security breach that turned out to be caused by using the default username/password for the host account.  As a result I never presume that DNN is necessarily the cause of a security breach (see Occam's Razor).