I would recheck logs and content hosted on the website and its subdomains

Maybe one of the other users has something really out there being shared in another subdomain

(Or it might not be a customer - but someone who found a vulnerability and is hosting questionable content unbeknownst to him)