Might be a third party client, browser extension, insider threat... not necessarily a compromise of the Twitter backend.