The code, found lurking on the British Airways website, may be how hackers stole data on 380,000 transactions.