but the zap receipt is not created by the client, the LNURL server is the one to publish the zap receipt when the invoice is paid
Discussion
From NIP-57: "The zap receipt is not a proof of payment, all it proves is that some nostr user fetched an invoice. The existence of the zap receipt implies the invoice as paid, but it could be a lie given a rogue implementation."
So all you need is a rogue lightning node.
yeah, or a user pretending to be a lightning node posting fake bolt11 invoices :)