I have not played with fake zaps. All zaps should be from my cln node: #[5]

make sure you are verifying the zapper key from the lnurl endpoint and are not counting zaps from random keys.