So, it looks like we've had a fresh attack today (around 15:50 UTC December 24). I am aware that there's now a BugZilla request - http://bugzilla.wikimedia.org/show_bug.cgi?id=8322 - and Brion's reply is worth noting...
The obvious way to fix this would break the actual purpose of <includeonly>,
which is to keep special links such as category links meant to belong to target pages from being indicated on the template page.