A Reddit user Reeceeboii_ highlights, any time you share a song from within Spotify, it generates a unique tracking URL linked to your account. Spotify can join the dots between the sender and receiver whenever anyone clicks on this unique URL. People have allegedly noticed that Spotify has retroactively filled out the history of song shares in the Messages feature, which is possible through these tracking URLs.
For example, the share sheet on Android is still terrible. Something that could be fixed by adding a way to customize it quickly (whitelist a few apps and manually pin+sort a few contacts/apps)