This is possible because your files are on the hard disk, so anyone with full control over whatever operating system is running on the computer has full control (including full access) to your files. This is the case when running Ubuntu or another OS from a live system (live CD/DVD or live USB), and this is also the case if someone were to take the hard drive out of your computer and put it in their computer.
You can get a reasonable degree of protection from this by encrypting your home folder, making sure to only store your files in your home folder (of course back them up somewhere else besides this computer, though...and make sure the backup is secure), and using a very strong password. The password is stored, encrypted, on the hard disk, so if it's weak, the encryption can be cracked pretty easily. See this comic for a relatively accessible explanation of some of the issues relevant to password choice.
Encrypting your home folder is an option during installation, but you can also enable it on an already-installed system by following the instructions in this guide. It is recommended to encrypt your swap partition too, which that guide also explains.
The reason most users do not encrypt their home folders (besides not knowing that it is an option or not being extremely concerned about the privacy of their data) is that, often, the person trying to access your files without your password is you. This also complicates (but does not usually prevent) recovering data from the disk, even if it is mostly intact and you remember the password.
If you want to increase your protection, make sure the password you use for your Ubuntu system is not the same as or even similar to the password you use for anything else, such as any websites.
