Potential unauthorized device enrolment in Apple Business Manager

There is no such thing as an unauthorized MDM. To install MDM, you either

1. Must purchase the device from Apple or an authorized reseller and have it added to Apple Business/School Manager and have an MDM connected for automated device enrollment
2. Someone must have physical access to your device and must have your passcode/password.
3. Someone must have physical access to your device, your iCloud password (assuming you've set that up), and be in a trusted location (or wait for an hour, again, assuming you set iCloud up), then they have to wipe your device and add it to Apple Business/School Manager manually.

Option 1 cannot be removed by you because you don't own the device.

Option 2 can be removed in Settings > General > VPN & Device Management.

Option 3 can also be removed in Settings > General > VPN & Device Management if it has been less than 30 days since the device was enrolled. You would likely notice if this one was the case as again, at a minimum, it requires the device to be wiped.

These are the only options.

If it is popping up when you wipe and reset the phone, it will tell you the name of the org doing the management.

If you happened to buy the device used, please see: The All Too Common SAD Reality of Buying … - Apple Community

Personal Apple Accounts CANNOT be added to Apple Business/School Manager. ABM/ASM does not support accounts ending in iCloud.com, me.com, gmail.com, aol.com, etc.

What you are likely seeing is a compromised iCloud account.

Nope. Didn't happen. Why don't you try actually describing the problem instead of jumping to conclusions about MDM's and device compromises...

Start with where, exactly, did you buy the phone?