Tweets posted through Twitter's ads platform, even non-ads scheduled tweets, will show up as normal twitter web posts.

And approved partners can use the corresponding API to post this way.

I've not checked twitter api docs but I've seen stuff like "Posted from: Zombo smart fridge" and was under the impression an app could fill that field in with whatever they like.

Its not hard to fathom that someone who was able to pull off a hack like this could have also found a way to mess with the metadata there.

But is it necessarily true that the authentication token was generated with the same app used to post the tweets?