The diagnostic tool from Google says the following.
Safe Browsing
Diagnostic page for winstonduke.com
What is the current listing status for winstonduke.com?
This site is
not currently listed as suspicious.
What happened when Google visited this site?
Google has not visited
this site within the past 90 days.
Has this site acted as an
intermediary resulting in further distribution of malware?
Over the
past 90 days, winstonduke.com did not appear to function as an
intermediary for the infection of any sites.
Has this site hosted malware?
No, this site has not hosted malicious
software over the past 90 days.
Personally, I dislike the report from Sophos. As bluefeet pointed out, it doesn't give you any time period when the malware was found on the site itself (it does give you a "Protection available since:" date in 2010 and it does give you a "Last Update:" in 2011, but these dates are meaningless to me, also they're really old even if they were meaningful). So in other words, Sophos doesn't give you any verifiable analysis, or any possibly falsifiable claim.
If sophos.com continues being a problem on StackOverflow, and continues giving warnings without useful information, I'd suggest that StackOverflow blacklists it as malware/alarm-ware/spamware itself, and automatically prevent users from entering that url in questions or comments.
That being said, had Sophos given a more verifiable report with an actual time frame, or with an actual date of the discovery on the site itself, or better yet, should another more mainstream scanner had agreed with Sophos, I think the first person who finds the problem should edit the question and post a warning next to the link in question (while at the same time, making the url non-clickable, but still make the url human-readable and copyable for those who want to double-check it. And also post the link to the site that actually gave him/her the warning/finding as well).
A warning in the comment is great, as was done in this case, but unfortunately by the time someone gets to that comment, he/she may already have clicked on the link, and already infected his/her computer.
Ideally, this should not even require the intervention of a moderator (unless there is suspicion that the malicious site was posted on purpose). And if the user doesn't have enough reputation to quickly edit the question, or is waiting for others to approve his edit, he should at least post the warning as a comment. Other users with high enough reputation (who we assume agree with the warning given) can always do the rest.