Onesignal spam push notification. how?

These messages are not sended by me. but how these spam push notification shown on my app?

This is the reply from onesignal support. but my api key didnt share with anyone. Actually i wonder how this happens??

Let me know if anyone happens like this.