It seems like this was caused by email aliasing: https://twitter.com/CodeRedOnly/status/1669748007955312642/photo/1
That was ripe for accidental or deliberate misuse.