FWIW you can probably report that. While trying Bluesky, I reported some crappy stuff and I can’t remember any that was still up when I checked later.

How did she find my account?

Just like Mastodon/AP, data is mostly public by default. I assume it doesn’t take much to find new accounts to spam. We’re usually talking about bots here, not normal user accounts, just to be clear.