It happens because the vast majority of microstock sites do not use https for login, so data travels in clear from node to note and anyone having access to any of these nodes can log it. That's a lot of people.

Other than that, dictionary attack, or spyware in your PC.