You Might Have Gotten An Email From Twitter About Your Account Being Compromised (techcrunch.com)

Unless Twitter has made the ludicrous mistake of not hashing passwords, a bulk compromise probably means one or more (hosting providers, some weird API middleware) third parties were compromised and leaked access tokens. A password changes invalidates all the old ones for an account.

Also, if you look it's mostly journalists, etc. complaining rather than normal people, so it seems more concentrated among those more likely to use third party services.