Unfortunately there are a number of methods hackers use with the Pharma hack  so here are some refs: with things to check

This post covers a number of CMS but just look through the WP stuff.

http://redleg-redleg.blogspot.com/2011/02/pharmacy-hack.html

Then these two articles.

http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/  http://wordpress.stackexchange.com/questions/19696/verifying-that-i-have-fully-removed-a-wordpress-hack

Once you get things cleaned up you submit a Reconsideration request to get the warning removed.  It is important to note in the request that you are submitting because your site was hacked with a Pharma hack and is labeled with the compromised warning in search results.  Note in the request that you have cleaned things up and secured your site and include a couple of example URLs that used to include the spam and are now clean.