They find your password from hacked websites and then guess that you might have reused it somewhere else. But they are usually sending these messages from hacked email accounts too, so signing them up to spam won’t achieve much.

Best thing is to avoid reusing passwords too often and to change them every now and then. And ignore scam emails like that one.