Strange Hack of WP-Admin CSS folder

I’m going to try to explain this but I may not have the right terminology.

I’m working on a site for a client of mine: http://clickinforlove.com

He got a strange email from someone saying we were using a picture without permission. They found the picture at:

http://clickinforlove.com/wp-admin/css/clyfford-still-museum

Thing is, there’s no such file on the server. When I looked at the wp-admin/css/.log/clickinforlove.com I found 2950 other records of other sites accessed from the wp-admin/css folder.

What the heck is going on? Why are these css pages returning anything but a 404 error?

Any help would be greatly appreciated.