I was hacked because at the time I set up a free account I used an old default password I'm pretty sure shows up in a leaked dataset. I suddenly noticed message

I was hacked because at the time I set up a free account I used an old default password I'm pretty sure shows up in a leaked dataset. I suddenly noticed messages showing up that someone played music from a device I don't own. I changed my password and deleted all offline devices. It's entirely my fault, still it's odd that spotify wouldn't notify me of suspicious behaviour, since they kind of pay for it too.