I've updated to the latest yahoo-transport in github. Every time I connect I'll get 11 authorization requests from spamming contacts. I'll deny all of them and next time I log in I'll see the exact same ones.
I turned on dump protocol and I can see I'm getting the contacts from the server. The odd thing is when I login using the yahoo account type in pidgin (not through xmpp server) those contacts don't show up. I've attached some of the code below. The ones that are masked with XXXXXX are my "real" contacts that appear everywhere. The full names are the "ghost" contacts.
Response from server with ghost contacts
Forgot to mention that when I do hit deny I don't see anything in the logfiles being sent back to yahoo. Which is probably why I keep seeing them everytime I login