http://example.com/users/[object] instead of
Also, check your server logs and you should at least find an IP address next to the line that shows
[object]. Also look for the referrer field in the log (which is likely the last entry in apache logs) as well as the time the request happened. If there are multiple requests for
[object] where the time between each is less than a few seconds apart, then chances are, someone or something may be trying to find a vulnerability in your server. A cure would be to block the offending IP address.
Another thing you can do is use mod_rewrite to filter URLs if your server is apache and you have sufficient access to .htaccess files. By this, I mean you can make it so that if URL's contain strange characters, you can make the server show an page with an HTTP status of 410 (aka GONE). This has the advantage of telling any search engine (particularly Google) that may have such screwed up URLs indexed to stop indexing them.