Possibilities:
It could be a new malware payload. Users who use spotify on compromised devices have their login details stolen.
Another website or service has been compromised that isn't particularly useful to those who got the data out of it, so the malicious users took the information they got from that service and tried the logins/passwords on spotify, saving the account details that worked as "leaked" data.
The user data could have been Phished from the users in question. "First spotify sends me an E-mail asking me to reply to confirm my account details, and now my account is hacked! dang you spotify and your poor security"
