Sounds like someone cloned the account and is running the clone in an unofficial version, that’s why you didn’t get locked out in the original installation.
Whatsapp allows to sign in by scanning a QR code in the web app, I believe that’s how the unofficial apps work. So maybe the person got tricked into scanning something?