It just happens to be the first I've seen use Google Analytics to track the lulz with CSS and @font-face. With that layout I was expecting to see a customer rant, not a "pwned" message.
On a more serious note are they going to be able to afford to have a separate EC2 instance per customer to avoid having to write a proper sandbox?