Who have access to Administer ➔ Site building ➔ URL aliases depends on how you've set access to the permissions
administer url aliases and
create url aliases under Administer ➔ User management ➔ Permissions. If you've granted access to the Anonymous user role, everybody can do it. If you've granted access to Authenticated user role, a rogue authenticated user can do it.
First, check out these permissions and make sure they are safe. Leave them unchecked for all roles. Then, only the super admin (user #1) can create aliases using the GUI.
If these setting are secure, and you still get unwanted
url_alias entries created, then some outsider has gained direct access to your database. That's bad.
Finding the cause of database intrusion is not easy. Possible attack vectors are: A bad module that permits SQL injection, some means outside of Drupal (an inscure phpMyAdmin is the most common cause), or (in particular if you're on shared hosting) a host misconfiguration.
However, without having direct access to your site's and its log for forensics, it is impossible to know how an outsider has gotten into your database (if that is indeed the cause).