From the wires:

Police probing the Madrid terrorist attacks found a van with detonators and an Arabic-language tape with Koranic verses, and officials said they were not ruling out any line of investigation.
The van was found in the town of Alcala de Henares outside Madrid after a tip from neighbors. On the front seat police found seven detonators and the tape...

Three of the trains bombed Thursday originated in Alcala de Henares, and one passed through it...

UPDATE: Then there's this:

DUBAI (Reuters) - A letter purporting to come from Osama bin Laden's al Qaeda network claimed responsibility for the train bombings in Spain on Thursday, calling them strikes against "crusaders," a London-based Arabic newspaper said.
"We have succeeded in infiltrating the heart of crusader Europe and struck one of the bases of the crusader alliance," said the letter which called the attacks "Operation Death Trains." There was no way of authenticating the letter, a copy of which was faxed to Reuters' office in Dubai by the London-based al-Quds al-Arabi newspaper.

The letter bore the signature "Abu Hafs al-Masri Brigades." The newspaper received similar letters from the same brigade claiming responsibility on behalf of al Qaeda for a November bombing of two synagogues in Turkey and the August bombing of the U.N. headquarters in Baghdad.

However, the same brigade has apparently made false or unsubstantiated claims in the past. They were one of three groups claiming credit for a Turkish bombing. They falsely claimed responsibility for the recent Northeast blackout.

On the other hand, the bombs were probably made with titadine, a form of compressed dynamite. This is referred to as an "ETA trademark." The ETA stole some titadine along with a Breton group in 1999. See also this and this.

More on this incident here. This article has quotes from a Janes analyst supporting the ETA theory, but other information not ruling out it being AQ or even a combination of the two groups.