I didn’t realize I hadn’t revoked that compromised mini app, Schedly, but I traced this BS to that malicious signer and revoked access.
Surprised nobody told me there were spammy casts from my account, but I’m glad I caught it sooner than later.
For peace of mind, go to your Farcaster settings -> advanced -> connected apps and revoke anything you don’t recognize.