The short version of the answer is, of course, perhaps you have been hacked, but there’s not enough information provided to know for sure.
I have seen attackers insert replacements for some core files onto a compromised magento installation that dump source code (and, more importantly, configuration values like database logins and passwords which they can use to manually insert CMS block content into your database that will get injected into every page rendered by your site to, for example, skim credit card numbers used during checkout) instead of executing the source code.
Of course, in order to do this, they need to have already compromised your system so that they can upload files to your web server; but that is not necessarily very difficult to do, depending on your web server configuration and how up to date your security patches for your installed software happens to be.
I am also guessing that the Mandarin character that is being printed in your described test scenario output may be pushing you in the direction of thinking you might have been hacked, and that’s not an unwarranted deduction.
I’d recommend that you use one of the publicly available security scanner tools to check your production environment to see if it’s been compromised and verify that it is fully updated with all of the latest available security patches.
Some options I’ve used with success in similar situations include:
- MageReport - great scanner and doesn’t require you to install any software on your system. This may be important because if you ARE hacked you will want to be able to capture an image of your system’s hard drive with as little changes as possible for forensic analysis. Depending on your local, regional and national laws (and the terms of your merchant processing agreement with your credit card processor), you may be required by law to make an an image of your system or preserve it intact when you contact law enforcement to report the incident.
- MageScan - a great open source utility from Steve Robbins that does require installation on your system but can analyze some details that aren’t necessarily observable from an external scan.
- You may also have the n98-magerun utility installed on your production system which you can enhance with the Magento Project Mess Detector extension to determine if any of your Magento Core files have been modified. While not technically a security scanner, per se, it’s a tool I use often when analyzing systems for security compromises. To avoid destroying any evidence which by law (or contract) you might be required to preserve for future forensic investigations, you will probably want to clone your production environment into a VM and run these tools against the clone, even if you happen to have them installed in your production systems (which is normally not a recommendation I make).
Finally, if you haven’t already done so, please make some time to review the Magento Security Best Practices Guide, which includes a lot of other useful information both for responding to situations like the one you face and (more importantly) preventing them from occurring in the first place. It contains content from many of the authors of the tools listed above (full disclosure : I was also a co-contributor) and it will provide you with additional suggestions of actions you should take to address the security questions you may face.