If I understand direct messages correctly, everyone can see WHO I am sending the message too. Perhaps the spammer watched everyone who sent nostr:npub1ew4nntskh08fzkwjusrc9u5627g639c5z6udc4q3a3plr9ns4naqxp6qlf a DM and then scraped their profiles. some non WoS users got it too.
Discussion
that could be. I got the message to my lnd node as well. though I don't think I ever sent bob a DM and my WoS isn't linked anywhere.