If you want an analogy, [read this][1].

As for the list of vulnerabilities:

 - Emails can be sniffed in transit, since they are not encrypted (_some_ sites will opportunistically employ encryption for transit, but this is not reliably activated).
 - Emails will be stored on physical disks in the servers which are involved in the operation: the sender's email server, the recipient's email server, and any server "in between". Physical disks can be sniffed when decommissioned or through backup tapes. Bored interns in the facilities managing these servers could simply have a look.
 - It is easy to make emails go to the wrong machine by altering the DNS.
 - There are viruses which routinely inspect emails received by infected machines, in search for passwords, credit card data or other juicy information.

The whole email system just assumes that everybody is honest and nice and trustworthy. It is surprising (but morally encouraging) that it works at all.


  [1]: http://security.stackexchange.com/questions/9487/how-can-paypal-spoof-emails-so-easily-to-say-it-comes-from-someone-else/9498#9498