People typically use variants of the same password across the web. It's a huge starting place for breaking into an email account.

Also, since it's vanilla http, you could sniff these passwords at a coffee shop's wifi all day and just wait for someone to log in to Pandora.