I’ve heard back from the boys at
For AFS (which is what your home directory is on) ... [w]hat matters is what the AFS acl [see section 4.1 of PDF] (access control list) says for that directory. ... You had system:anyuser rlidwka on your home directory and all sub-directories, which means that any user had full rights on any directory in your home. I've removed all of those.
How my ACL was switched to the ‘rape me’ setting, I don’t know. (Neither does AIT — there’s no way to check, and the user  who “owned” homepage.html doesn’t exist.) However, I do thank “A.J.” for bringing it to my attention. Oh, and