Hacker News Reader

And how are such lists constructed?

You just breach someone with a lot of them.

Would it not be easier/more legal to scrape them using leaky login forms?

I believe the breached lists rapidly become public. You can find them on the internet.