I emailed them too (also spoke to Aaron) and was told that they had left the Spark address exposed in the public .well-known/lnurlp string for testing purposes and it was only removed right before the public release. He didn’t follow up when I tried to dig deeper on the invoice question.