It is unlikely to be a Spotify breach, but if the password was unique to Spotify then that certainly adds a little more weight to the argument.

Usually it is simply a case of ‘credential stuffing’, where other data breaches are checked against other common/popular websites, with the goal of finding accounts that work and can be sold to others for illegal use (TV streaming services etc.)

Overview of credential stuffing can be seen here: https://breachinsider.com/blog/2017/credential-stuffing-how-...