> Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account.
The spam tweet posted on my behalf was automatically deleted.
(Edit: For reference, the spammy link pointed to a domain called apaloreto dot info, but led to a 404 in my case)
If Twitter used the same app token for iPhone and Nexus twitter apps, and your Nexus twitter auth cred was stolen, they could use an implementation of the twitter client API with the iPhone user-agent, then post with your creds. I have absolutely no idea if any of that is accurate, but it might explain the access.