Of course, anyone can send transactions to us without having the need our private keys. But with that having 0 tokens sent, it's making me believe that this is just another dust attack.
From what I think, maybe there's a fake token from the attacker that sends it to anyone that he's got their addresses and that's to know if the address owner is responsive or active because they'll eventually move that away from that wallet. Also, don't click those tokens because they'll direct you to their website and with an interest of exchanging them, that's probably where the scam starts.