at0m is right about checking the refer in the access logs.
If your hosting service is using apache, there are plenty of tools that can parse the logs and give you useful information. That way you can figure out what is going on without having to know what you are doing. ;)
If your host won't give you the information, then do the following:
1) Change the name of the file
2) Update your site to point to the new filename
3) Replace the old file with something horribly offensive
4) Slap a watermark with your e-mail address on it, that says "Offended? E-mail me at..."
5) Wait for the e-mails to roll in and find out who is leeching your picture!