I had someone create a spotify account on one of my emails with an old (clearly burnt) password as the the username.

Why? I figure that's generally either for spamming or viewbotting (Re: likes, stars, etc) purposes especially on sites that don't require email verification to do things.