properly salted hashs can still harm many peple. You could still run a brute force on the top 10k most common passwords and with ~150m averge computer users, you're going to get a few. And you have their email address. There's a good chance they're using the same password for email. Now you have their email.
With user-individual salts and assuming 100ms for a password trial, 100ms * 150e6 * 10e3 is approximately 4750 years, and while this can be done in parallel, it's not exactly a small amount of resources you'd have to devote to get these relatively simple passwords.
