The big problem here is that people create accounts on multiple sites and then reuse the username/passwords on many sites. Then, one of the sites gets hacked, the database gets leaked with unencrypted passwords. Eventually this database gets passed around the internet for anyone to use. Now people simply go down the list trying to log in with these username/password combos on every site.