Thanks for bringing that up. Right now it is unsure if they have keys or using a posting authority.
It doesn’t appear they have their own authority and are either using someone else’s they has access to or more likely using actual posting keys farmed via an app or accidentally leaked.
They don't use steemconnect. I signed up to check and you have to enter your posting key onto the side. It's probably saved into their own DB. So everyone who is affected by these fuckers should change his/her keys asap.