There are posts about OP’s server being hacked, but there’s zero evidence that they put any leaked secret key on their server. Someone more connected to OP suggests that it might be backdoored desktop software.[1]

Your average user will install whatever crap they find on the Internet. Hell, a friend of mine (in their 20s, not a grandma) recently installed god knows what when “Windows support” called. And it’s not the first time a friend fell for this kind of scam.

[1] https://twitter.com/peterktodd/status/1609655629903265795