I don't know if it was that clients fault and I don't want to point any fingers. All I know is that I logged into it this morning. Then an hour later I noticed this issue because someone DMed me to say they sent me a large tip. I said oh, I didn't get it and started to investigate.
Discussion
Time to break out that new POW key. Though i guess if you don't know if or how the key was comprosed might not help or could happen agian.
I am wondering if a client did something it shouldn't have done. I'll give them benefit of the doubt for now and think maybe it was an accident that they had this happen, testing something and hopefully forgot to remove it from a dev environment before going to prod.