From the comments of that Cracked article:

"We had a similar problem at work, but we figured out the IP of the person doing the direct linking and dished out the images they expected to that IP, but the rest of the world saw an ad for our site."

One to consider for next time?