Index page won't display, unless re-named - weird hijack of CSS

[Cloudscape]

I have an index page (simple splash page, with graphics, external CSS stylesheet and external java counter, and an ICRA - child protection - label). It displays just fine on Macs in all browsers. It also displays fine in all browsers on PCs, running Windows... except some IE6/PC users find the page loads with no images (including the background image).

The only other thing that's probably relevant is that I have an .htaccess file restricting media access to authorized domains.

So forty computers on my client's two networks, some of their contacts, and many individuals cannot view the index page. But if I duplicate the index page and change the name from "index.html" to "indexB.html" the pages DOES display.

Then one guy, who couldn't see the images, retrieved the CSS stylesheet from his IE cache, and found something very weird.

Instead of:

.backgroundredblack {
background-color: #D1D9DE;
margin: 12px 0px 0px;
border: 0px;
background-attachment: scroll;
background-image: url(/media/czd5blackredbg.gif);
background-repeat: repeat-y;
background-position: center top;
}
.backgroundred {
background-color: #D1D9DE;
margin: 12px 0px 0px;
border: 0px;
background-attachment: scroll;
background-image: url(/media/czd5redbg.gif);
background-repeat: repeat;
}


His retrieved version said (this references an adult site, so the *** are mine):

.backgroundredblack {
background-color: #D1D9DE;
margin: 12px 0px 0px;
border: 0px;
background-attachment: scroll;
background-image:
url(http://www.d*cke-beulen.de/engine/href=/czd5blackredbg.gif);
background-repeat: repeat-y;
background-position: center top;
}
.backgroundred {
background-color: #D1D9DE;
margin: 12px 0px 0px;
border: 0px;
background-attachment: scroll;
background-image:
url(http://www.d*cke-beulen.de/engine/href=/czd5redbg.gif);
background-repeat: repeat;
}

All the graphics on the page are called in from the same 'media' folder.

Does anyone know what can be causing this problem? My client takes security very seriously, as do most of their contacts and have all manner of levels of protection installed. But the problem is also affecting quite a few random individuals worldwide. For every person I could find who COULD view the index page, I found one who couldn't.

It feels like something working against my client's URL at browser level, but could be at server level and only 'work' on IE6 on PCs?

It gets weirder, because I have been spammed a couple of times from the URL referenced in the 'weird' CSS anomaly. At one point they were hijacking bandwidth and taking images from my client's site.

NB: I won't post a URL to the index page yet. The index page is a non-adult splash page to a reputable UK adult ecommerce site, and I have temporarily set the index page to refresh as 'indexB.html', so the graphics display. I can reinstate the index page after this weekend, if anyone wants to try to see the problem in action.

I wondered if there's a potentially serious issue here - maybe one that people have encountered before?