I’m currently leaning towards Twitter tried a bunch of things to stop this and hootsuite got caught in the fray
Or maybe it was a multipronged attack that included social media management software and OAuth
but the hilarious most visible solution is that Twitter now disabled all verified accounts
and they should keep it that way