Well, yeah, but simply having an email address and password to a forum that contains little to no personal information is kind of worthless. Even if those passwords are the same as for other websites, how would he know which websites to use them on, unless trying them randomly on stuff like social media sites?

If somebody does use my email address to do something, I guess that could be a problem, I could be getting all sorts of stuff from creditors and such when I have no clue what is going on. That address is associated with me, so I could get into trouble, I guess.