It means someone uploaded it there and verified the address in the identity (or subidentity). A keyserver is exactly for "here's my key, use it".

Don't publish your keys if you don't want them used. It's not that difficult.