Can you be more specific? I might be able to hunt down answers.
Recently, federation vulnerabilities got exploited by an ex-Truth Social employee who apparently believes consent is only when someone shouts "no" at him, so pretty much anything is possible (without even going through the effort of spinning some kind of proxy server, if I'm reading this correctly).