Each e-mail is allowed 5 accounts on Neopets. 1 main, 4 shells (that's you're not supposed to use for anything except storage, so ideally you shouldn't have any trophies, games played, anything to do with NP on it). Unless you're permanently switching accounts to make a new main, because you had a crappy username on your old main, or for whatever reason. When you do that, you're apparently not allowed to earn NP on either account for 24 hours.
Same passwords doesn't seem to be something they should be able to use since that's illegal. No one, not even the company, is supposed to know your password if it wants to be secure. The only getaround I can think of is that they look at a flagged account, get the hashed password, and scan their database for it. I bet a lot of people actually have the same password though. Don't tell me you never wanted to put "iloveboobies" or something

Probably if the hashed password AND e-mail appear on more than a 5 records of accounts, AND if you've been making NP off more than 1 account, they'd probably freeze those ones, maybe freeze all.