This thread on drupal.org is a great example of the open source process, from complaint/suggestion (passwords are stored as plain MD5 hashes, vulnerable to lookup tables), through denial, persuasion, a bit of (understandable) naive ignorance, the appearance of an expert (solardiz, the author of phpass) with time to explain the principles, someone to write the actual code (pwolanin), lots of revisions and finally acceptance: Drupal (in version 7) now uses phpass to store secure, stretched passwords, as does Wordpress as of version 2.5 (released this week), and they're both compatible.
The problem with passwords stored as MD5 hashes in a database is that if anyone gets access to the database they can use an MD5 lookup table (or brute force password guessing) to find the original passwords, and then use those to access the site without anyone knowing - or access other sites where the user has used the same password.
In summary:
So using a unique salt for each password makes it much harder to crack a password using lookup tables, and stretching the password makes it harder to guess a password using brute force. I think that's right, anyway.
See also: Enough With The Rainbow Tables: What You Need To Know About Secure Password Schemes