From what I can tell after the event, the vandal was using a commons picture that they uploaded a different picture over: [1] and [2].