What ended up happening is the @theshop account had its private posting key in its posts as apparently intended. The phishing hackers probably figured they hit the jackpot with zero effort. They started posting their phishing links.
Then myself, @guard and @arcange found it. Thus the screenshot above. Their comments were visible for just a few minutes until they were flagged and the account itself had its reputation hit to -1 by me with @spaminator.
In the meantime, some random troll found the account and started having a great time with it. The troll deleted most of the phishing comments and then started editing posts and resteeming @haejin.
Another user, @mwfiae, replied to my comment and let me know what was up. I logged in with its key and cleaned up the troll's mess. Then I left a comment for @hyperfundit to which he immediately responded to on Discord. He changed the keys and the account is once again free of phishing and secure.
