These files aren't on my server. How are they showing in Google Analytics?

If you're worried about your web server, your first call should be the log files. If it was a hit to your web server, you will see it in the access logs.

However, it could also just be tracking code re-use. Someone else made a site, copied your tracking code, and accessed those two pages on their own server. Google Analytics allows you to use the same code across multiple domains, so all this traffic will appear in the default "All Web Site Data" view for the property.

To eliminate this as a possibility, try adding a filtered view that only includes your domain.