They state that they are using the rooki bot in this post.
https://github.com/hdevelopments/rooki-lemmy-bot/
The bot has the functionality to send posts/comments/user to a designated discord server as posts in a channel which exposes the data to discord's data collection which is not protected via their https://discord.com/privacy
Finally one of the main lemmy.world admins Antik doxxed a lemmy.world user he suspected of being me, deleting it after another instance admin pointed out that it was doxxing (In addition to me) while I did not save the screenshot itself it was of a database query tool that showed the email the user used to register on lemmy.world, and as far as I know they also log IPs but "are only using it do deal with the DDoS"