Any unencrypted traffic will be at risk. You can use TLS/SSL enabled protocols to prevent passwords from passing in the clear. Depending on your email software you can use IMAPS and SMTPS to secure your traffic, or STARTTLS on IMAP and SMTP to prevent passwords from traveling in the clear. SFTP can be used for file transfers.
Internet traffic passing in the clear is vulnerable to password harvesting anywhere along the connection. Open wi-fi makes it easier to capture the data at the endpoint.
Any passwords you want secure should never be sent over unencrypted connections. Always use HTTPS for web based log-on wi-fi or not.
Use anonymous credentials for windows shares, FTP, and similar protocols. Only information which can be safely make public should be passed in this manner.