Is It Illegal to sell passwords? Is it unlawful in the United States to sell passwords of other people? If the passwords were obtained through malicious attacks on an organization's database, does that affect the legality?
Assuming here that this is without the permission of the current account-holder. As discussed above, from a tort law angle there would be some confusion as to who owned the password in the first place. However, under US Federal Criminal Law, such action is explicitly criminalized: Title 18 USC§ 1030(a)(6)(A) [Computer Fraud and Abuse Act] provides that: (6) [Whoever] knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if— (A) such trafficking affects interstate or foreign commerce; or (B) such computer is used by or for the Government of the United States; ... shall be punished as provided in subsection (c) of this section. Subsection C then sets a punishment for such a crime at a fine and/or imprisonment for up to 1 year. Repeat offenses (this applies to any past offense under any part of the CFAA, not just password trafficking) have a maximum sentence of 10 years.
Since you don't say which country you're in, it's likely that you're interested in United States law. You are probably in the clear here, though you're getting close enough to the edge of breaking the law that I wouldn't be confident about not being prosecuted and/or convicted. The relevant laws in this case appear to be 18 USC 471, 18 USC 472, and perhaps 18 USC 514. All three of them begin "Whoever, with the intent to defraud...". It's questionable whether creating counterfeit money as a burglar decoy counts as defrauding the burglar.
There are a number of existing legal sites that do this, for free or for pay. The main concern for a website operator pertains to the DMCA "safe harbor" provisions, which protect against vicarious liability for infringement. A "report piracy" option is not sufficient; see this answer to a related question.
People running web servers are generally liable for contributory culpability, when some user breaks the law by putting the material on the server. There are legal mechanisms for relieving the server guy from this burden. The best-known mechanism is "DMCA takedown", where you publish contact information so that an offended person can serve up a proper legal claim that you are distributing material that they own copyright to. If you follow the rules, you may enjoy "safe harbor" protection against contributory liability: one of the requirements is that you have to take infringing material down. The specific requirements can depend on the nature of the liability and jurisdiction, but generally involves a "hands off" involvement where the person has no knowledge of what's going on on his server. So just disclaiming responsibility does not work. There are other more serious violations, such as distribution of child porn or transmission of top secret information. Jurisdiction is not totally central to internet questions, and I could sue you (the server guy) in US courts, or (depending on the offense: copyright infringement of a particular item) in UK courts. Nailing this down specifically to Sweden is harder, but recall that The Pirate Bay had a whopping judgment against them.
First of all, a password is not personal data. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; From GDPR Article 4 (https://gdpr-info.eu) As for password hashes, what do you mean by requesting a copy of yours? You can produce it if you knew the hashing algorithm of the website. By the way, websites should be using good hashing algorithms, such as bcrypt or scrypt, not MD5 or SHA1.
Your code is considered free speech (Bernstein v. United States) and you have allowed the use of the code via the MIT license. Since the application of your code is very generic and is not specifically targeting anyone. You probably are not criminally liable. This is simply writing a "Proof of Concept" for security testing purposes. That same way Metasploit, Nessus, and Nmap have actual exploit code but are considered tools of the trade. Now if you go around using your spyware on non consenting victims. You might get a visit from some people with guns and badges that have 3 letters on them.
Given a large database of email addresses that you can't prove have given consent to receive email, the only legal thing to do with it, is to (securely) delete it. (I am going to switch your question about a larger company to a bank: in the UK, big pharma is forbidden from advertising to individuals.) In principle the rules are the same for a huge bank and everything down to a self-employed plumber. In practice the plumber will be told "don't do that again" rather than fined. This case was treated under the Data Protection Act, which has a maximum fine of £500,000&nbsp;&ndash; so a big bank would probably have been fined more, but not necessarily much more. Under GDPR, fines are related to turnover, so the fine would be a lot bigger for a large bank. The incident is a year old now. Details here.
Because the company that runs the contest is not in the banking or medical industry, or in another business or organization (NGO or governmental) that has to protect personal information by law, your login, email and password can be stored on pieces of paper scattered around their office and it's not illegal. And there are no laws regarding sending your information in plain text in an email. Yes, those are bad security and privacy policies, but they are not illegal. (This may vary by jurisdiction). The TOS (Terms of Serivice) you agreed to are at Eye Win Awards Privacy Policy. Part of it reads: By providing us your Information or by making use of the facilities provided by the Website, You hereby consent to the collection, storage, processing and transfer of any or all of Your Personal Information and Non-Personal Information by us as specified under this Privacy Policy. You further agree that such collection, use, storage and transfer of Your Information shall not cause any loss or wrongful gain to you or any other person. and We cannot guarantee the security of our database, nor can we guarantee that information you supply will not be intercepted while being transmitted to us over the Internet. And, of course, any information you include in a posting to the discussion areas is available to anyone with Internet access. You agree to the TOS and Privacy Policy simply by registering and using the site. This is known as a click wrap (Wikipedia) contract. You can choose to stop using the service, or by the company can choose to void the contract and close your account. You can complain, but it is entirely up to the company to address your complaint or even reply to you. The Grievance Redressal contact in India is at the bottom of the link above. There are probably consumer advocacy groups in India; Google will show you those.