I noticed the same use of upload bandwidth. Worse, using dtruss on Mac OS, I could tell that it was reading files out of places other than where it was installed (e.g., ~/Music/). There was no way to tell what files it was exfiltrating from our network. I had to ban use of Spotify in my company for this reason.