It could be that the app uses the api key (despite it being disabled), and somehow someone was able to steal it. I hope it isn't sent in plain text.