Discord link sent out from League of legends messages

So today someone or something sent out mass messages to my friends on my client. A Discord link to be exact (ofc I haven't clicked on it). But if you type that link letters in discord you come to something called "The sewer reborn". Has anyone else gotten this stuff recently? I've changed my password and for some reason I am still logged in on a mobile device, only that I am not using that stuff. I've submitted a ticket to Riot support so hopefully they can force logout all devices from my account.

I've also done some research about this stuff and it looks like this has been around since 2 months back at least. How is this issue still not fixed? If it's the mobile device app, fine that's out of Riots reach. But how can it be possible for someone to login to someone elses account with a "unknown" device without a verification sent to your mail first? Steam has this so why can't League of Legends have it? The security would be so much better for us as users and we would not be so dependent on Riot support when we have these issues. Now I have to wait and hope that none of my friends gets the same stuff as me...