It's a website. Anyone can go to wix.com and create an exchange. People will deposit money there. When you use poloniex, bittrex, bitstamp, or any other "exchange", it's just a person who wrote a webpage and you are sending them your bitcoins. If they are asleep, your money won't show on the page till that person wakes up, checks his wallet, and edit's the web page to reflect your deposit.

Just because Poloniex has 10,000 users, doesn't mean it's anything more than just a web site that takes deposits. They will try to make users happy until they don't care any longer. Then they will give up and keep the money like MtGox did.

MtGox was the first exchange, run by 3 guys in an office the size of a hot dog stand in Japan. The owner was french, Mark Karpeles, and he lost interest in caring about his company because he made over a million per day in trading fees. So hackers got in and got most of it.

These are all just web sites

They are honest until they decide not to be.
See what the world's largest Bitcoin Exchange looked like - and it's CEO