I've seen this a couple times on my site where some spam posts are published. The author of the post is an existing user, however, the user in question did not post the content, so there's definitely a bad actor posting on their behalf.
If the user logs off, then all is well, but if they log on let's say a week later, then a new spam post gets published.
Anyone have any insight to what may be going on?