Sorry, currently I cannot reveal that, because information that should be private is leaking this way. We’re still busy removing posts.
I’m seeing older threads here suggesting you need to modify functions.php to keep forum posts out of your RSS. Like this one: https://bbpress.org/forums/topic/private-posts-showing-in-rss-feed-widgets/
No, the “rss feeds per page” setting doesn’t allow values < 1.
We have the same problem. We just installed bbPress as a private forum, for logged-in members only. But posts appear in our public example.com/feed (and get replicated by Zapier to social media)