A followup on this: I haven't seen this problem (a single "hit" on my script) since Apr 28 and before that Mar 12. I think Shaw took care of this problem shortly after we started monitoring it. I don't think I ever got a good "real hit" since I implemented the watcher program; where the output showed anything unusual.
I'm disabling the watcher program starting now, and we'll see how it goes.