* A hacker has a leaked database
* Your email and password are in this database
* Your public email is the same one used in the database
* Plain-text passwords are easy to extract from this leaked databases
* You use the same password and email combination other places
* Other places with that email/password don't use two-step authentication
Then if they have your email they can get your password and try it other places
This is the problem. Every password for every account you create should be unique. Bonus points if you use a unique email alias for every account you create too.
