Accounts are groupings of subaddresses for presentation purposes. There is also the side effect that when you spend out of an account, any outputs received at any subaddresses within that account may be combined. This is purely wallet logic.
Funds cannot usually be spent across subaddresses which span multiple accounts because of wallet logic. The wallet requires you transfer funds between accounts (which automatically gives you one level of churn if you do so).
Note that neither subaddresses nor accounts ever appear on the blockchain, because outputs simply appear to have random one-time public keys. You only need to worry about linkage if the same person (or colluding parties) gave outputs to you via many of those subaddresses, and are now observing the blockchain to see if those outputs are ever referenced together in a transaction. Third parties cannot make sense of anything.
Any kind of combination of outputs across subaddresses (whether from the same account or different accounts) will risk linking those subaddresses together, only in the eyes of someone that knows about outputs given to you at those particular subaddresses. There is no such thing as linking accounts together, only linking particular subaddresses together.
So the bottom line is, if you spend outputs together in the same transaction, and those outputs spanned several subaddresses, then those subaddresses are at risk of being linked regardless of whether those subaddresses were all from the same account or from multiple accounts. And again, the risk is only there if someone knows of outputs sent to each of those subaddresses, because only one-time output public keys are written into the blockchain, and addresses/subaddresses are never written into the blockchain.
Finally, if there is no prior suspicion that subaddresses may be linked, then someone is going to have to send multiple outputs per subaddress to you on multiple occasions in order to know whether they're observing random references to outputs or a real pattern. This greatly reduces the threat.
Think of it like this: every time there is a transaction, fresh notes with fresh random serial numbers are given to the recipient. Any time someone spends notes in a transaction, the whole world (via the blockchain) is told about the new random serial numbers generated, as well as the serial numbers of notes that are spent together in that transaction. In addition to the serial numbers of the actual notes being spent, the transaction also includes the serial numbers of lots of other notes that are randomly chosen from the blockchain as decoys. This means no one can be sure which notes are really being spent, but coincidences can be spotted under very particular circumstances by people that gave out particular notes to a particular person whose real identity they know. That's pretty much all the knowledge you need to be able to directly reason about the threat involved.
( answer originally provided by knaccc )
