How much anonymity does an average mining pool provide to the user (securing your email, other personal information)? What is the best pool to use if you want to remain anonymous, and which is the worst?
Eligius is the most anonymous pool I know of, as it doesn't require registration. Quoted from the Bitcoin wiki: "To use it, a miner merely needs to be directed to mining.eligius.st on port 8337, with the username set to a valid bitcoin address (which receives the payout). No registration is needed."
Pools I'm aware of that have been hacked include nofeemining.com (userids, passwords and emailed were published to the web - the administrator didn't actually notify users of the extent of this. The pool has since closed), ozco.in (this was treated very seriously), and abcpool.co (some balances stolen, but treated seriously). However, if anything, the likelyhood of a being hacked again is probably less than some of other mining websites that haven't yet been compromised.
Given that most pools require little more than an email address (and you can create an anonymous email address easily enough on various websites), a user can choose to remain reasonably anonymous with minimal effort.
Perhaps the biggest risk to user anonymity is through your IP address - if you provided personal details to an untrustworthy website, say dodgyexample.com, and then mined "anonymously" at a theoretical site dodgymining.com, your IP address could be used to link the accounts details as being owned by the same person.
Further to the above, the payouts you receive through a pool may be linked back to you through the Bitcoin blockchain, depending on where you spend your bitcoins and whether you have shifted them between wallet addresses before you spend them. This is unlikely though, as you will most likely spend your bitcoins somewhere that the malicious individual cannot link back to you.
It depends entirely on the pool. Some pools are extraordinarily careful with user credentials, others aren't, and except for the cases where the pool has published their code there isn't usually an easy way to determine which is which.
From an anonymity perspective, the best pools would be those that require only a Bitcoin address, typically entered in the username field of your miner. Since these pools never store email, password or other potentially sensitive or revealing information, they do not have the ability to reveal such information in the event of a breach.
It is worth noting, however, that even these pools will still have access to the IP address(es) of your miner(s), although they may not actually store such information. If you want maximum anonymity, you should also take steps to anonymize your IP as it appears to the server, such as routing mining communications through TOR or a VPN of some sort.