Sites get hacked and they get your email and password and any other details on you. They then target you with a scam email. I have had one of those emails before ajn or they try to login using those details to other sites.
I now use a password manager and it generates a different new password for any site, allthough if someone really want’s to get in they can run some program and run a text file with a dictionary or try every combo possible so is only a matter of time till they would get in..
Many years ago now, had a hacker login to my ebay and listed a brand new hdtv for sale buy it now for 1p