Comment by JamieH

The TXT record isn't being sanitized so it just echos out the script tag which then loads the JS file.