The theme they are using has an old version of TimThumb from 2010. I found this article that lead me to a newer timThumb.php file.

http://www.wpbeginner.com/wp-tutorials/how-to-fix-and-cleanup-the-timthumb-hack-in-wordpress/