This is one of the more amazing bugs I can recall seeing.
If a page has a plain external link to an image file with no markup, e.g.
Then opening the Visual Editor on that page results in the external link being replaced with an actual fully rendered copy of the image. I haven't the wildest clue why an external link to an image would be translated into HTML markup that displays that image, but that seems to be what is happening.
I tried a few more dangerous file types (e.g. js, css, pdf) and those do not appear to be rendered / included, so apparently it is something specific about external links to image file types.