Logwatch shows entries that do not exist

Logwatch shows

A total of 13 possible successful probes were detected (the following URLs
 contain strings that match one or more of a listing of strings that
 indicate a possible exploit):

    /wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php HTTP Response 301 
....

I enter

find / -name "NativeChurch"

I get zero results.

I enter

find / -name "wp-config.php"

I get two results.

/var/www/vhosts/result1/httpdocs/wp-config.php
/var/www/vhosts/result2/httpdocs/wp-config.php

I enter

cd /var/www/vhosts/result1/httpdocs
cd wp-content/themes/NativeChurch

I get

No such file or directory

I enter

cd /var/www/vhosts/result2/httpdocs
cd wp-content/themes/NativeChurch

I get

No such file or directory

Why can I not find the file? The server is the right one. The logwatch is current.

EDIT:

find / -name NativeChurch -type d

I get zero results.