Well, that is a very good point, lets add that up as one of the reasons.
We had a discussion here regarding this issue couple of months ago and I was suggesting them that maybe these emails have been used in different website discussions about cryptocurrency, but there were who claimed that they didnt used their emails from any other website except the exchange. So, what we are suspecting was, the involvement of the exchanges in such issue. Idk really, but that was just the closest theory that we ever come up with. I could be wrong, least we can do here is to regularly check our accounts and emails to prevent from being robbed.
You can use free service such as haveibeenpwned.com to notify you if a website containing your data were hacked.
I doubt exchange would sell their customers data, the risk when being found out is too high. It's more believable if an exchange got hacked and its data leaked to internet.
Case of Bitcoin exchange being hacked are not new here, There's always at least one exchange hacked in a year.
Maybe, just make a strong password will be at least 8 characters in length, but the more the better. The longer (more characters) your password is, the more time it will take the hacker to crack it.
You can use KeepPass to store and generate random password with more than 25 characters long, but if a website stores your password without salting or even worse, a plain text then it won't matter how many characters you set on your password.