Let us suppose Alice sends a message to Bob.
As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then encrypts plaintext+MAC by random one-time symmetric key, which is, in turn, encrypted by Bob's public key.
Padding oracle attack allows Eve to reconstruct the plaintext+MAC by sending modified versions of Alice's message to Bob and observing whether the modified version will trigger padding error or MAC verification error (when Bob will try to decrypt the encrypted message by symmetric key).
It is said (e.g. Should we MAC-then-encrypt or encrypt-then-MAC?) that switching to encrypt-then-MAC should mitigate the possibility of attack. In that scenario, Alice first encrypts plaintext by random one-time symmetric key, which is, in turn, encrypted by Bob's public key, and sends both encrypted message and its HMAC computed using her private key.
I don't see how that prevents padding oracle attack, as long as Bob accepts messages from everyone (including Eve). Eve still could modify Alice's encrypted message, compute HMAC using Eve's private key, and send it to Bob.
Does encrypt-then-HMAC actually prevent padding oracle attack in this scenario?