The metadata api and libspotify provide the popularity score for songs. Perhaps they searched for tracks with popularity of zero. I don't know that zero popularity implies zero plays though.
They also could have implemented a remote control of the desktop client with some screen scraping. Or reverse engineered whatever internal communication the desktop does (though I suspect Spotify would have put a stop to that).