Maybe private DMs on Mastadon aren't as private as everyone thinks... that, or the open nature of Activity Pub is leaking them somehow?
Edit - From the article:
Even more shocking is the revelation that somehow, even private DMs from Mastodon were mirrored on their public site and searchable. How this is even possible is beyond me, as DM’s are ostensibly only between two parties, and the message itself was sent from two hackers.town users.
From what @delirious_owl mentioned below, it sounds like this shouldn't be very shocking at all.