Why it looks the way it does
Hijacked accounts are run by scripts. They post the same message into as many channels as they can, as fast as they can, usually with a link. That pattern, one message everywhere at once, is what makes them catchable.
Turn on Discord's own protections
- Server Settings → AutoMod: turn on mention spam blocking and the suspected spam filter, and add common scam phrases to a custom word list.
- Server Settings → Safety Setup: raise the verification level so brand-new accounts can't post right away.
- Require two-factor authentication for moderators, so a hacked moderator account can't kick or ban.
Add a spam trap channel
Make a visible channel at the top of the server called #do-not-post, with a topic telling people not to post there. Real members never post in it; a script posting everywhere will. Treat any post there as spam and act on it automatically.
If it gets through
- Delete the messages (Foreman's /purge can remove one person's recent messages in a channel).
- Time the account out rather than banning it: it's usually a real member who got hacked.
- Tell them to change their password, turn on two-factor authentication, and remove any Discord apps or connections they don't recognise.
- Warn your members not to click the links.
How Foreman handles it
Foreman's spam shield is on by default. When someone posts the same thing across several channels at once, he deletes the posts and times them out. Add a #do-not-post spam trap in the Builder (Safety → Spam) and one post there trips it. AutoMod rules are set up from the same Safety section.