Site Compromised?

I recently got an automated notice from my hosting provider that a file in your plugin is an indication my site is compromised.

The following file(s) specifically have been identified as attacker-added malware. We have DISABLED these files by … You will need to audit these files and either replace them with known good versions or remove them altogether:

/…/gmc-mca.org/…/wp-prayer/modules/export/tcpdf/tcpdf.php

The existence of this known attacker content indicates that your website or user password has been compromised. You or a trusted webmaster will need to determine the attack vector and then take actions to mitigate further exploits.

Is this a false positive or is it a correct identification?

The page I need help with: [log in to see the link]