I think I read something about how when you block a domain, it only blocks content hosted on that domain. But a text post, for instance, gets copied over to your instance and served from there, so it's still visible. That's why there's so many posts from "kbin.social" that are actually from Lemmy.
If that's the case here, then better blocking is needed.
This seems like a fundamental flaw. There NEEDS to be a user level privacy control for disallowing your posts from being copied to a place you don’t want it to go.