There is a good chance that the person whose password is stolen uses that password on other sites. I guarantee you that if you steal enough usernames and passwords, you'll find a lot of people who use the same credentials for their email, bank, PayPal, etc. Actually, they just need your email, and from there they can reset your other passwords and click the confirm link once it goes to your email.

The financial incentives can vary...they can make fraudulent purchases, transfer money, steal domain names, hack sites, you name it.

EDIT: For a real-life example, when I worked at Internet Brands (makers of vBulletin), a hacker managed to obtain administrator passwords on sites we owned running vBulletin. He then used that administrator's account to install a plugin that gave him access to the whole user database. He then used that database to log into other sites we owned (it is possible to google a vBulletin username to see what other sites they are members of). Once he had admin access on a dozen or so sites, he added dupedb.com links to all of them.