Alot of it is social engineering or common sence. If they have managed to log an email or hack a site which has a password which can be linked to you or your email then its likely you used the same password for other things, paypal, ebay etc. Also if your username is John_smith then they may try things like john/smith or smith1982
With sites like facebook and bebo out there people are putting more and more personal details online and when they know your name, dob, or location and intrests guessing a password becomes alot easier.
Best thing to do is have random passwords with letters and numbers. Dont use the same password for every site. That way at worst if a password is compramised it only lets them into one thing.