How can a site rank for keywords that aren’t anywhere on its pages?

A site for my client’s competitor shows up on a SERP for keywords that never show up in the site anywhere (not even hidden in the source code). How is this even possible, and isn’t this spam? What can my client do about it? Land Lubber, Colorado