Shawn dropped an XSS attack waaaay back when the site was still in beta.
IIRC, he managed to log in as Jeff Atwood (one of the site's co-founders) and run a script which upvoted EVERY post on the site. He re-ran the script the next day to downvote every post as well.
In his defence, the site was in beta so we were all supposed to be trying to break it. You can hear Jeff speak about this at 36:50 of SO Podcast #37
Jeff also wrote a blog post about the details of the exploit and the fix:
Imagine, then, the surprise of my friend when he noticed some enterprising users on his website were logged in as him and happily banging away on the system with full unfettered administrative privileges.
That's right -- whoever loads this script-injected user profile page has just unwittingly transmitted their browser cookies to an evil remote server!