It’s a scenario that could realy become reality, but as the information is easy showed by social networks. I believe that this kind of password and usernames “trade”, may be reported to the company fast by one “trust employee”.

Companys shal have a “Information Security Police” explaining to all employees the rights, duties and responsibilities that they have, when they are handing with data that can be used against the company purposes.

-Expecialy if this is a personal data, like a login and password.
-Above of all, it’s responsibiliti of the owner the integrity of his passwords.

Of course that we all know that – OSI model layer 8 , also know as “user” :D – can make things that we can’t expect. But, this kind of action “sell login and passwords” may be classified as a “crime” in some countrys that have specific legislation for this actions.

The company “Information Security Police” rules should deal with this kind of problems, to future auditorships and etc, etc, etc…