Hi Ton,
I guess you already got a reply from them. I also asked the developer what could be the cause. here is his answer:
Ton already contacted me by email regarding the "ghost messages". I deleted his apikey so he can request a new one. I need to investigate what happened. To be honest, I guess that the problem was on my side instead of someone stealing his apikey. The bot collapsed a few days ago and maybe during the restart some messages were sent to the active user who was Ton in this case... The workload on the bot behind the API is increasing rapidly so I'm adding a new instance (new server, bot, whatsapp number, etc.) to make it more stable and deliver messages faster.
I also asked if it is possible to revoke a key or ask for a new api key. He is working on that feature.
