There can be two reason
a) either you click on a link, granted rights to your google calendar and the third party malware did the job
b) your friend google's calendar got malware attack by granting rights to an unauthorised third-party app and you get the anonymous app
The solution,
Log in to google calendar and observe the anomalies and get in touch with google expert