Thank you for your swift reply.
If no other Volumio/Spotify users are in the Pastebin list, then Volumio can be excluded as suspected.
Then it might be reuse of the same username passwd combination which was used also by an already hacked account of another kind.
However it is still a mystery (and time to change all passwds)