So it was due to a misconfiguration in their GitHub project, that inappropriately accepted a PR? Or because a random account was added to the project?

I don’t see it in the commit history either. There’s one merge on the 13th, and it was immediately reverted. Have they modified the history?