If you use the relay.snort.social relay then there is a bug in the underlying nostr-rs-relay which causes it to return events that don't match the query in a very specific case. https://github.com/scsibug/nostr-rs-relay/pull/176

I thought about adding in client side validation. but I think that would add too much overhead and it would obscure the bug in the relay