There are a lot of ways which could be used to hack into your account.
Firstly, a lot of people use the same password to register everywhere. If you create account on the vulnerable website, then someone could hack into that website and get your credentials (stored at database). Then attacker has your e-mail, your password and if that password is the same as the password to your email-box, then he has an access to your e-mails.
Secondly, the next thing could be a very common password. If you use password like
qwerty then it's very huge probability that your account will be hacked. There are a lot of bots/crawlers in the Internet which collect e-mails and try to log into grabbed account by using common passwords. Of course they just use a few tries (preparing brute-force attack will be blocked e.g. by CAPTCHA).
Moreover, phishing is a nice trick to extort your e-mail and password. There are a lot of ways to trick users to type their credentials on the fake website. Some of them use social engineering, rest of them: more technical tricks, like tabnapping.
We shoudn't forget about malware. Keyloggers (or even mouseloggers for virtual keyborads) intercept typed passwords and send them to the attacker.
Creating a secret question (to help us in e-mail recovery) could be a problem too. It's not a method used for mass-email-stealing, but it's pretty effective for specific people. Obvious secret question like (
what's my name or
my favourite color) could be easily guessed or extorted by social engineering methods.