@h3artbl33d There was also this in a recent Twitter thread (of an account now suspended): "This is all thanks to an exploit in October of 2019 that allowed one to access the group page with recent messages if proper permissions were not set up. At the time of writing this, the team at Telegram have been contacted about this. I've only ever seen two people mention this exploit in passing, one in person and one on Twitter, so I know I was not the only one."
@h3artbl33d Have yet to see any more information about that exploit, but then I haven't really gone looking.