Well, you have to recollect what were you doing on 2024-02-21 06:45:42 (UTC). My guess is that one of the three things happened:

• you've misused some tool while setting those properties
• the tool you were using has a bug and sent such transaction while you wanted it so send something else
• since the transaction only changes posting_json_metadata, it requires just posting key - any of the myriad of accounts you've allowed to sign in your name could do that (or someone those accounts allowed to sign in their name)

The last possibility could be checked if we managed to decode public key from signature - it is possible, but I don't have the tool at hand at the moment.

Edit: ah, there is also possibility that you've leaked your private key :o)
Edit2: the key that signed it is the private key associated with STM5wJarof5LWBiQu2umDUWgg1xD5QHpKQC1Z97sE2aoQdwQ8DwMf which is your own key.