All combo lists come in the form of Username:Password or Email:Password.
A lot of these are 500k plus lists of leaked users. Grab these and compare to your system to ensure that no potential vulnerability or leak exists.
A lot of entities are using these lists in cracking systems to gain access to user accounts for profit. Generally these are sold on to other, if a reward system exists those accounts with rewards are sold.
Or in the example of Spotify entities use Family accounts to sell spots to upgrade a free account. Unbeknown to the person holding the family account.
