Presumably only checking the `pubkey` field of a given event and ignoring everything else

Sort of an obvious thing to miss, though. Shouldn't they at least check that the repost belongs to someone you follow?