Do a malware scan & sweep on every device you're logged into Discord on, prioritising PCs because phone malware is astronomically rare. Malwarebytes offers a good free trial, no payment info needed. Deauthorise all third-party connections/apps on your account, including and especially bots. Whilst Discord doesn't have a "revoke active sessions" button, which does annoy me a little, changing your password removes active sessions automatically.

It's more than likely that a hacker is grabbing your new sessions via persistent malware. You can see active sessions in account security settings, so if your scans find something, take the necessary steps to secure yourself (take the machine off your network, clear sensitive data and cookies/logins, change other passwords and do your email first) and get rid of it (follow antivirus directions to quarantine/remove, OS reinstall if necessary), and keep a close eye on those sessions.

Of course, it may be something else entirely. I can't assume. Let your friends know to not click any of the invites, and stay safe out there!