Using email:pass combos is not illegal if you have explicit permission to test them against a service—for example, in authorized security assessments or penetration testing. Without permission, using or distributing such combos violates privacy laws and can lead to serious consequences. Always ensure you have proper authorization before testing accounts to stay within legal and ethical boundaries.