A link to a buy Viagra online site was built on my homepage!

A friend of mine, lawyer, just called me panicking and said a client of hers visited her site and saw a “buy Viagra compare” link in her header! I logged in to her site and first i noticed the link is not visible when you’re logged in as an admin, second, I can’t find it anywhere in her WP dashbored, at first I was sure it;s something from one of the plugins she added but nothing. Please help!

[Spam moderated]

this is from her view source (*again, this is there only when not logged in) how can we get rid of it?!