So let's say that the jquery.com server was not compromised... What else could have caused RiskIQ to see the injected script tag at the end of the body element?

Could there have been an injection at the ISP? Was it a DNS heist? Or another BGP compromise?

I must admit I'm quite intrigued and looking forward to seeing what the investigation uncovers.