Firstly, you need to get an API key from StopForumSpam to access their database. They haven't been real forthcoming about publishing how the maintain their database or how or if they do any checking for false positives in their data. I found that they actually listed Google as a bad guy in one of the data pulls I did from them. The hack itself has had a history of sloppy coding with vulnerabilities that needed to be patched. It is totally dependent on the single source (SFS) for its data checking and that source, as mentioned, can be flawed. It sounds a lot more serious than it actually is however. Generally, the bad guys listed are for real bad guys. My experience has been that when people get rejected mistakenly, they never report it so you really have no way to check whether the tools is doing the right thing or not.