VERY strange issue with bogus URLs (shows *all* pages)

Check this out:
https://www.azaleabaptist.org/awefwaef (should be a 404)

It’s showing all the pages (not posts) on a single page!

The .htaccess:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^calendar/?$ wp-calendar.php [QSA,L]
RewriteRule ^calendar/([^/\.]+)/([^/\.]+)\/?$ wp-calendar.php?year=$1&month=$2 [QSA,L]
</IfModule>

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

# Fix for blinking FIR in IE
ExpiresActive On
ExpiresByType image/gif A2592000
ExpiresByType image/jpeg A2592000
ExpiresByType image/png A2592000

The activated plugins:

Akismet
Bible Verse
Calendar
cforms
ChurchSite (custom, shouldn't be causing this)
Google Analyticator
Role Manager
Subscribe To Comments

Curious if anyone has seen this issue before! It’s a significant issue because additionally, it’s sending a 200/OK header rather than a 404/Not Found and search engines frown upon that sort of thing!