ClemaX

But the article of the DMA says that the gatekeeper shall not prevent the business user to serve their product using other conditions than those of the gatekeeper's platform. I think that would include Apple's publishing guidelines.

Then it may be a token stealer.

If your account is linked to your Google, Apple or Facebook account that might be the culprit (I think you can see this in yout account settings). You need to check that because the consequences could be way worse than just having access to your Spotify account. You can use HaveIBeenPwned to look for leaks matching your e-mail address or password.