@dragontamer correct. Maybe they don't have your credentials but only your session. Allowing to execute tasks that are available for admins within the admin panel or any other moderation tool on the site.
Kbin doesn't use custom emojis as far as I know. But it could potentially spread to any software that doesn't escape the content that is getting displayed. Whether the software is kbin, lemmy, pixelfed or mastodon. Or whether the content is a post, thread, comment or user name/ description to just name some options.