Either way, OP can't do anything about it if he not the sender.
Note: Sending that kind of replacement requires a little technical knowledge on how bitcoin and bitcoin wallets work
since mostly all wallets with rbf-related GUI feature doesn't have the ability to reduce the amount of input used in the original transaction.
And it's actually easier if the spend transaction isn't in the sender's node/wallet (not rebroadcasted yet) since he can just "abandon" it and use "coin-control" to select that specific input.
If re-broadcasted, he'll have to either manually drop it from his mempool or manually create a transaction via createpsbt / createrawtransaction
The question is, in case of a malicious sender: He got all the time in the world to replace it, why wait now?
Perhaps it's OP's failed attempt to CPFP while he's the actually sender, let's wait for his reply.