All of the above you mentioned, plus at least two more:
1. For a user who re-uses passwords across different accounts (ie. a great, great, great many users), a password-database theft from one service allows a malicious actor to just retry those credentials at a wide array of other sites. Often successfully.
This tactic has proven successful in password breach after password breach, and is probably the most efficient way that a bad actor can quickly get into many valuable accounts. Concrete example: if a given user's email address and password are stolen from, say, LinkedIn, a malicious actor then just goes and tries those same credentials at Bank of America, Citi, JP Morgan Chase, Paypal, and other financial (and other sites of interest) with very large customer bases. The attacker plays the odds: try stolen credentials of a person who re-uses passwords on enough very-popular services and you'll often hit an account where those re-used credentials work. Even if this try-as-many tactic works for a very, very small percentage of user credentials in a given stolen database, if the database we're talking about contains millions of records that's an incredible feast for any malicious actor who gets access to them.
(For purposes of keeping things simple here, let's assume that whatever compromised password database I talked about above was not protected by very robust password hashing, resulting in malicious actors successfully cracking a large proportion of password hashes stolen so they could recover the original, plaintext passwords and try to reuse them. Like, well, what happened with the hack at LinkedIn.)
2. The often-overlooked but devastating tactic of password reset abuse.
As a user you can do absolutely everything right when setting a password for a service--don't reuse a password from anywhere else, use a lengthy & randomly-generated string with lowercase letters, uppercase letters, digits, and special characters--but still have your account hijacked. If, that is, bad actor can simply reset that password. How does that happen? Well, most frequently it happens because some very prominent services still use the god-awful practice of guarding password reset with quite-guessable security questions. (Some of them have even allowed attackers to make unlimited attempts to guess the answers to these questions correctly.) But sometimes an attacker doesn't even need to accomplish that; customer service reps for services will sometimes be lax about proper procedure and reset a password even when an attacker can't answer the questions properly. Most famously/infamously, this is what happened to journalist Mat Honan when a hacker breached his Apple account and deleted the contents of all his Apple devices.
Setting up two-factor authentication with a service (if the service offers it) to authorize password reset can reduce your risk, as can trying to avoid using services that rely on weak authentication mechanisms like security questions. But that still leaves the possibility open that a poorly-trained, poorly-monitored customer service rep will get tricked into resetting your password for an attacker. And about that threat a user can do very little.