When sending a Drupal database to a developer, how can I remove users' personal info (e-mail addresses, passwords)?
Drush supports an sql-sanitize function:

    $ drush help sql-sanitize Run sanitization operations on the current database.

    Options:

    --db-url=&lt;mysql://root:pass@127.0.0.1/db  A Drupal 6 style database URL.
    Only required for initial install - not re-install.

    --sanitize-email        The pattern for test email addresses 
                        in the sanitization operation, or    
                        "no" to keep email addresses         
                        unchanged.  May contain replacement  
                        patterns %uid, %mail or %name.       
                        Default is "user+%uid@localhost".

--sanitize-password     The password to assign to all        
                        accounts in the sanitization         
                        operation, or "no" to keep passwords 
                        unchanged.  Default is "password".   


    Aliases: sqlsan


You could always setup a clone of your live site using drush archive-dump or drush sql-sync then run sql-sanitize on that cloned sites db and get everything cleaned. I believe sql-sanitize provides a hook so you can sanitize custom drupal data you deem sensitive beyond the scope of the default username and password.