It is legal, but staff can't do anything if your account gets stolen and you shared it with someone. It is illegal for staff to let anyone on their account though.
In the
rules it says (unless these are outdated?):
"You are solely responsible for the safety and security of your GraalOnline Era account. If you are a victim of account theft and found to be knowingly sharing your account information with another player, GraalOnline Era Staff may not be able to assist you in retrieving your account. Ensure that your emails and passwords are safely stored."
"You may share your account at YOUR OWN RISK."
I think a sort of optional inventory pin wouldn't hurt though.