It wasn't all free — e.g. for many people, mail was provided by their ISP or a paid service — but I was also thinking that the mentality expanded rapidly. Search is a natural spot for advertising (and doesn't need to be privacy-invading) but over time that moved to include lots of other things, increasingly run by advertising companies like Google or Facebook who were content to run the service at a loss because they could resell user activity data.

The main thing I was thinking in regard to that last point was that while early community sites weren't perfect, there was at least some pressure to maintain community health. If I ran a site like photo.net I had to keep photographers interested — too many scam ads or bad behaviour and the most valuable people will stop visiting. Since you're running your own infrastructure, you have more options for differentiating your site and it was harder for spammers to make sleazy ripoff clones as is now common.

These days a lot of that stuff happens on places like Facebook or Twitter, where they will optimize for “engagement” with little interest in the health of a particular community and things are encouraged to leak across communities unless they reach the level where users stop using the entire service and/or advertisers stop buying ads. As long as people have a boredom behaviour of opening your app it's seen as working well.