[bobbydavid]

I always thought it was like "patient 0". The day-counting started once the exploit was first exploited, meaning the first to exploit it was doing so on the 0th day.

[tptacek]

That would also make some sort of sense, but isn't the origin of the term.