lucy24 - 6:31 am on Dec 11, 2013 (gmt 0)
The last three shared-hosts that I've had allowed open directories above my domain root to serve their own images.
I caught bots crawling these images early on and installed blank index files into the same directories (didn't think that would be possible above my root, however it was).
How does that work, physically? I mean, what URL are your unwelcome visitors requesting?