If your push notification server keys are exposed, anyone can send notification using any tools.
Not the application issue.
===
Goto your Firebase Console.
Project Overview > Settings > Cloud Messaging
In the "Cloud Messaging API (legacy)" section, delete the server key and create a new one.
Then paste the new server key to the Foodomaa admin dashboard > Settings > Push Notifications > Firebase Server Key.