HTTP is a stateless protocol. Being logged into a website means that a shared state need to be kept between client and server. This is usually accomplished using a shared session ID which is commonly stored on the clients side as a cookie and on the server side in a database. If the attacker can make use of this session ID he can do actions as the authorized user.
Cross Site Request Forgery (CSRF) is a common attack to misuse this cookie even though the attacker cannot read the cookie's value. This attack is for example used to hijack and reconfigure routers so that they can be used to man in the middle any connections to the internet.
Other attacks steal the session ID for example using Cross Site Scripting (XSS). Of course the session ID can also be stolen by hacking the server or its database for example using SQL injection or simply be guessing the correct session ID in case of easily predictable session ID's.
While all these attacks can be done when the user is logged in a properly implemented logout invalidates the session ID which then can no longer be misused. This way the attack surface is reduced.