I understand the basics of what the attack is trying to do, but one thing really bothers me. If Harvard Architecture is supposed to have a strict separation of code and data, how is the initial buffer overflow allowing the attacker to rewrite return addresses on the stack? Since the architecture only allows data to be read into instruction memory via the SPM instruction--one that is specially reserved--I just don't get where the ability to rewrite the ret pointers is coming from. I feel like I'm missing something obvious.
I believe the architecture you're interested in - the AVR - is actually a modified Harvard architecture, whereby instruction memory can be accessed by instructions as if it were data. (I haven't used the AVR in a while, so I don't recall if you can execute instructions out of RAM.)
The ARM Cortex M processors (perhaps others) are similar. There aren't too many pure Harvard architectures in new designs these days.
By the way (since you tagged your question with "atmega"), there is a good paper by Francillon and Castelluccia (PDF from ACM Proceedings) regarding code injection attacks on (modified) Harvard architecture devices, including the AVR.
Yes, the program can write to the return address on the stack. The CALL instruction has to be able to do it, and other instructions can too. The stack is just part of the data segment, so any instruction that operates on data potentially has the ability to overwrite the return address. There's nothing in the architecture that prevents it.