You’re right but then that means only a compromised admin account can do that (and that is the case on lemmy.world with Michelle’s account). The thing is it happened on other instances too, so I’m very inclined to think that there’s also something going on with comments or community sidebars.
when you see this huge thing, RUN FOR YOUR LIVES:
that’s the compromised custom emoji