Apple ID account being hacked?

Recently I opened my apple music and found a series of albums downloaded that I'm positive I didn't download. I also don't share my apple ID with anyone/dont have some sort of family plan. I immediately deleted the music and changed my password. Shortly after I noticed a 200 GB Icloud storage plan was purchased. I did not originally buy this nor did I enroll in some sort of renewal of the package.

I dismissed the situations until today I received an email showing a login attempt in Russia and the United States (4 seconds after) on my spotify. I never used spotify, but did have an account. What if the person using my apple ID automatically logs on to my spotify because it's part of my key chain? I've checked multiple forums and they all say the same thing, but I've run out of ideas honestly.