Once an attacker has a working combo, they can change the recovery email, locking the original owner out of the account.
Use a unique password for Valorant that is not used on any other site. Password Managers can help generate and store these securely.
These lists are often compiled from "Stealer Logs" —data harvested from malware-infected devices—or from older, recycled data breaches from other websites where users reused their passwords.