I've got a user who is part of our corporate domain, but who is
geographically separated, and connects to our domain via VPN client
through ADSL broadband. Trouble he's reporting has to do with an image
he used for a short time as his desktop image, but had thought he'd
thrown away.

He's got a new image as his desktop background. But when the keyboard
is locked out (screen saver timeout or manually by the user when he
leaves the PC unattended), the background image that appears is one the
user did use at one time, but had believed deleted from the hard drive.

Desktop|Properties is no help, because we can't find the file we don't
want to use. I'm guessing that the image for the lockout goes by a
specific name, but since I don't know what that name is, I can't find
the offending image (assuming that some rogue action previously copied
the image from it's original name/location to the system's preferred
name/location for lockout screen use.)

Can anyone advise on where to look from here? I can give the user admin
rights to temporarily deal with this, but don't know where to tell him
to look.