all someone has to do to bring terrible posts into the public timeline is create an empty account and follow users from another instance. it's that simple. replies between those users and users on blocked instances will show up too.
the latter sounds like a bug, doesn't it? but the former is almost certainly a """feature""".