Hi Tim,
I am aware of the built in web developer tool. My best guess is the same. However it is very unlikely that our IT staff would do that as a prank because the screen grab was sent to our network team to highlight a potential of hacking of our Moodle site. But upon checking, we couldn't find the same image on the site and none of the Moodle file shown any sign that it has been modified.