https://support.spotify.com/uk/account_payment_help/privacy/... for information how to do that for Spotify.
PS: why is your username so perfectly on topic?
The other one is a good question as well. Spotify pays out when a song has been listened to for at least 30 seconds. This has been abused in the past as well: https://qz.com/1212330/a-bulgarian-scheme-scammed-spotify-fo...
The article says it is not clear if the fraudsters abused existing user accounts or set up a farm. But apparently, the songs have been played. They all were exactly 30 seconds long - this is the minimum play time for a song to qualify for a payout.
Talk about easy to spot! Maybe the defensive team is deliberately keeping their countermeasures low-profile (don't block anything except payout) to make it harder for attackers to iteratively adapt? Similar to the way shadowbanning is magnitudes more effective than banning.