There's been a bit of a spate of template vandalism recently, and as a result a discussion on the village pump over whether or not to (semi)protect chunks of the template namespace by default - those with views on the matter might want to drop by there.
Anyway, I wanted to mention a couple of helpful tools for dealing with template vandalism when you find it.
a) If you look at the bottom of the edit page, there's a list of all templates transcluded in the article, so you can open these and have a look. It also mentions if they're protected or not - if not, and it's widely used, this might be a good time to do so. [Obvious, I know, but it took me a long time to notice them down there...]
b) This toolserver page - http://toolserver.org/~cbm/cgi-bin/queries/TemplateRevs?page=Example - will give you a list of the single most recent change made to every template transcluded in that article, in this case [[Example]] (a very template-light page)
Once you've found it, of course, you can clean up any other templates that have been hit and block the user - but sometimes they switch IPs. How best to find their next target? An old standby...
c) If all else fails, the holistic overview - http://en.wikipedia.org/w/index.php?title=Special:RecentChanges&hideliu=... - the template namespace isn't *that* busy, and it's possible to skim it by hand looking for large changes.
Hope this may be of some help...