Q: How to diagnose a thickbox log error

I'm getting a relatively measurable number of errors in my Apache log like this:

[Mon Nov 01 12:54:59 2010] [error] [client] (20024)The given path is misformatted or contained invalid characters: Cannot map GET /%3C?%20echo%20get_option(%27siteurl%27)%20.%20%27/%27%20.%20WPINC;%20?%3E/js/thickbox/loadingAnimation.gif HTTP/1.1 to file, referer: http://trackyourcandidate.com/

I'm not sure how to go about diagnosing this. I did a recursive search in wp-content to see if the theme for trackyourcandidate.com was using thickbox in any way, but it's not. I'm guessing the problem is that WPINC isn't being expanded, but I don't know where to look to begin to fix this.

Any starting hints would be appreciated.