How it happens precisely is still a mystery (to me) but learned the hard way early after losing my followings and events a couple of times.

Some clients have an option to backup the people you follow and your events (Iris, Nostrgram) and then there is https://nostryfied.online/ and https://metadata.nostr.com/ that allow you to backup your stuff too.

I think this can be triggered by a glitch in any app you're authenticated on since the app has write permissions for your profile, follows/unfollows etc. But I'm not a nostr dev. Maybe someone else can explain better.