Happened to me last week. Music stopped playing, said it was playing on some iphone, and now all of my recently playeds are bands I've never heard of. I changed password and it hasn't happened since. Something fishy is going on.
It is unlikely to be a Spotify breach, but if the password was unique to Spotify then that certainly adds a little more weight to the argument.
Usually it is simply a case of ‘credential stuffing’, where other data breaches are checked against other common/popular websites, with the goal of finding accounts that work and can be sold to others for illegal use (TV streaming services etc.)
Overview of credential stuffing can be seen here: https://breachinsider.com/blog/2017/credential-stuffing-how-...