They have been cloning notes and swapping media URLs on the cloned events with their hosted media file. Those cloned events are not signed by the users but are displayed as if the user created that event.