I've been asked to remove some Malware from a friend's site.

I've found some wonky links in the wp_postmeta table, but the post_id that the field is associated with doesn't exist - and, weirdly, it's way too high. I think the fields have the meta_key that starts with _feedback_

What is the easiest way to search the meta_value on those fields (seems to be JSON?) and delete the bad ones?

I found this post that suggested:

DELETE * FROM wp_postmeta WHERE post_id NOT IN (SELECT ID FROM wp_posts)

But when I ran (with updated table names) I got 0 results, which I feel shouldn't happen?

SELECT * FROM wp_postmeta WHERE post_id NOT IN (SELECT ID FROM wp_posts)