[2023] What in the world?

Having access to the source code makes it easier to pull this kind of stuff off, but it would've most likely happened regardless if it's public or not. You don't even necessarily need the game's code at all - it's quite easy to just look up the Steamworks API documentation, see what kind of a request you need to make to Steam's servers to get your server listed publicly, and write a program that sort of pretends to be a Barotrauma server and sends a bunch of those requests to Steam. And I actually suspect that's what these people are doing, I doubt they've actually got this many "real" instances of the game running.

But in any case, I'm sorry for the inconvenience caused by this. As mentioned in this other thread, we're working on implementing countermeasures against this, and I'm hoping we can get it patched soon.