I wouldn't read too much into the version 0 mistake. The history dialog uses some odd hueristics to order the operations so that rollbacks work correctly and sometimes it gets it wrong. Essentially the created event should be listed before the transition event, and transition events pull their version number from the event before them, which happened to be nothing so it got a 0. If you check the database I would pretty much guarentee it says the transition occured on version 1.
As far as how the file got there I don't know if there would be much of a trail to follow, are you sure they didn't somehow get user permissions to add files to the root as opposed to group permissions?
Thanks for the reply!
We don't give permissions at a user level, but I checked just in case and no permissions. Strange occurance, hopefully it doesn't happen more often!