This happened to me - apparently I spent 34 hours last year listening to a song called "Bear Claws" by an artist called Andrew Brady. I did some digging and all I could find was an Irish guy on Twitter with 2 tweets to his name. The song and the artist no longer existed on Spotify last time I checked. The odd thing is that these songs never seem to show up in my play history.

I did link Spotify to Facebook at one point, although I disabled all of my external apps on the Facebook side a long time ago and have used my username / password to log in ever since. I've never used a "playlist converter" or linked anything else to Spotify, as far as I know. My password has always been unique.

It should go without saying that if these access tokens have been breached they really should be revoked. I imagine Spotify will finally do something about it now that this has hit the mainstream press.