Many of us use the same password on our emails systems and we do for logging on to web sites.
So suppose your email address is
[email protected] and the password for logging on to your email is "football".
Now suppose when you register for a web site you use the same email and password, so to logon to say Amazon you also use
[email protected] with a password of football.
So every time you logon to that web site you are "giving away" your email and password combination.
Now we can trust Amazon, but suppose you register for a less trustworthy web site.
You register for a dodgy web site with
[email protected] with a password of football.
Now the owner of that web site has your email address AND email password.
So now they can log on to your email system and do whatever they like (order stuff from Amazon and so on)
As a MINIMUM you should use a different password for your email address as you do for logging on to web sites.
If possible you should use as many different passwords as you can, though this can sometimes be impractical, but at least make it as difficult as you can for scammers and hackers by varying your passwords and changing them as often as you can.