Of course it is while I am traveling that things like this happen...
Scary thing is I installed KaoMod myself on my laptop using the download from WowInt because I did not want to spend time getting the original directly from my desktop at home, but luckily it was a different version (I hope clean)
Anyway since I do not trust ZIP any more or less than executables (should the hackers have been smart and used one of WinZip past or present flaws and a more discreet Trojan/KL, we would still probably not know about it) I will discontinue publishing KaoMod altogether.
As for WowInt there is not much that could have been done I guess. Something along the same line happened even with the official Debian repositories. Only thing you can do is enforce use of hash signatures provided directly by Authors and clearly displayed on the site, like MD5 checksums. But then not anyone can do that, both on Authors and users sides.
Good luck,