The appeal process could have a security hole, it wouldn't be surprising if some request can be manipulated to seem as if you're appealing a Tweet of any content and have it trigger that automatic email. That's what it looks like to me given all else being true and the account wasn't really hacked.