A friend runs some SIP networks, he said sometimes when hackers get access to a line they make calls to premium numbers in North Korea and other places. They can run up a 5000$ bills pretty quickly.
I have a VPS, when I first got it, it had an additional user setup for some unknown reason. I didn't know it was there until my server was hacked by a bot. I'd suggest adding one step of checking the /home directory or other places to make sure no 'unknown' accounts have been set up.
I'm in my thirties, when I was younger I was certainly more willing to put in the effort to find the music I wanted for free. At the time it seemed much easier to find, for me. Now I pay 10 month for spotify and my effort is much less, but so is my interest.