On the home feed (on multiple different clients including Ivory, Ice Cubes, mammoth, and the Mastodon web app) posts are injected from accounts that are not followed, nor do they include any hashtags. How are they doing this?
I think it's not your home feed. It may be the global feed, showing all public messages from all the instances your instance is connected to.