To post you need to verify in the game, which makes it hard to create problems on the forum. However someone has been able to get users login information to spam cryptobro scams.
The most obvious way this would happen is people made accounts somewhere else and used the same email/password on both. When this other place was compromised they got access to the username/password database, which is usually useless...unless these people use the same passwords on lots of other places (a lot of people do this). If they did, they will be having serious problems now and may even be losing access to their steam accounts and stuff.
If it was a few it would be nothing, but when it's so many it implies the source of the leak is XI related and taking timing into account you can make assumptions.
If it was someone targeting XI players exclusively the links would have better bait (they may still be and the scammer is smart, but I doubt it).
Given the nature of the crap being posted, and a few websites recently closing it's probably likely someone working at the webhosting places got access to the databases of those closed websites and sold them to crypto scammers.
Nekosentai, ffxidats are potential sources if they didn't wipe everything before closing as well as private servers (but I'll give them the benefit of the doubt they are smart enough to properly protect their database)
Having said that, lack of trust in private servers is one of the reasons I personally didn't risk downloading it. My account is worth more to me than whacking a few crabs on some rando server.