Sneaky Query... how did this happen?

Try uploading your pihole.log, pihole.log.1, and the output of http://pi.hole/admin/api.php?getAllQueries to Tricorder: