Most of these compromises are phishing attacks where they send an email that looks like it's from facebook or yahoo or google or whatever that links to a login screen that looks real but is actually on a fake site that grabs your password.

You might think only newbies would be fooled by such phishing attacks but frankly they're getting better and better at it. I've seen phishing attacks I could easily have fallen for even for sites I'm *extremely* familiar with.

The most important thing is to NOT use the same password for multiple sites. Once they have your password for one site they try it on every other site and immediately gain access to those sites.

Do use 2-factor authentication if it's available. Especially for email which is often a back door to your other accounts through "forgot my password" things.