I maintain a mildly popular Twitter account that's mostly passive (schedules regular updates), hence barely follows anyone.
Recently I've noticed strange activity: my account started following people on its followers list sequentially, which indicates automated activity, reaching a total of 400 (not including people with private feeds). Suspecting that the account is compromised (I don't have any apps connected that are allowed to follow other than command line tools token on my laptop), I changed the password and revoked third-party application access.
However, I'm still at a loss as to what exactly was compromised.
Is there a way to get a detailed audit of Twitter account activity? (i.e. what app/API token was used to perform particular actions)
Assuming the actions were malicious, what possible benefit could a hacker get by making the account mass-follow-back its existing followers?