It could happen in other scenarios, if you generate incoming webhook URLs and don't treat them as secrets.

Once you get your hands on one of those, you've got a fair shot at a phishing attack.