If you gave them your posting key there is no way to know how they did that, using a posting auth you would know though.

But it's like all the dapps that could empty your voting power to self vote or something, it happened before and it wasn't too hard to figure out who did it and exile them.