This is a coinbase wallet, so I don't have access to the private key.

So the sender is using unconfirmed spent transactions to send my transaction? How is that even possible... would it be possible that coinbase is using CPFP on my transaction, since it came with high priority rate fee and they own my private key?