The congressman has denied that he posted the photo; it features a clothed crotch shot of an unidentified man. He blames hackers but has not outright denied that it was his picture.
The Daily Dot recently pointed out that Yfrog users had the option to email a custom address to post pictures to Yfrog and Twitter. You could email that address using any email account (without a verification process), which means that if someone had access to that address -- or the wherewithal to figure it out -- that person could post a photo to another user's Twitter stream.
Yfrog recently suspended this feature. A Yfrog blog post from Thursday reminds users of proper email PIN privacy practices and also states: "At Yfrog, we constantly evaluate our internal security mechanisms across all the facets of our service. Even though our email upload feature has not been compromised or broken into, we are taking this opportunity to evaluate the feature and secure it even further."