Once an attacker is on a network, they can sniff all traffic moving around it. Let's take, for example, a home WiFi setup that uses WEP.
- Attacker breaches WEP, because it's insecure.
- Attacker uses promiscuous mode to sniff frames on the network, and steals all traffic.
- You send an email via SMTP.
- Attacker dumps traffic a file and analyses with Wireshark or a similar tool, and extracts the emails.
It's as simple as that, and it can be performed with free software and off-the-shelf hardware.
Looking at SMTP relays, what you've really got to worry about is state-sponsored attacks. It'd be rather silly to assume that no government is sniffing SMTP traffic on these relays as part of their standard communications intelligence program. However, this doesn't mean that private individuals don't have access - the relays are just computers like any other, and they can be breached.
Furthermore, the traffic between SMTP relays bounces through several other machines and routers on its way, since there's no direct network path. Any one of these might be compromised.
In short, you have to assume that everything travelling over the internet is unsafe. It's an untrusted and hostile network, so you must enforce security.