Moral of the story. Be a ghost. Don't post anything you don't want the world to see, even in the DMs. We've now seen two beaches over a few months (chudbuds previously) and there will be more. Any patching will fix this exploit, but this side of the fediverse is obviously a target for small dick energy hackers.

Tl;dr the best security is to have nothing that requires security.