Here is a straightforward look at this topic for Links Beat.
Large websites are breached regularly, and lists of stolen email addresses and passwords are traded among criminals. Finding your address in such a list does not mean your accounts have been taken over, but it does mean the password used on that site should be considered public. The real danger comes when the same password protects other services as well.