Looks like this wasn't a Slack app, but just a regular user account... May be they had some browser automation setup to spam everyone.