If you gave them your posting key there is no way to know how they did that, using a posting auth you would know though.
But it's like all the dapps that could empty your voting power to self vote or something, it happened before and it wasn't too hard to figure out who did it and exile them.
Is there a way to set a floor? So when RCs get to a certain amount, the dApp is not able to use anymore RC until it regenerates some? That way a user could always guarantee they have say 10% of RC if they get drained.
Interesting
Yes exactly, all things come with risk and in most cases the community should be able to mitigate it properly!