This is a MAJOR security concern, which I know is actively being exploited across the country. There's one around the Duke building in downtown Charlotte as I write this.
Why is it a security concern? Because when your phone auto-joins that wifi hotspot name (which it does by default) you are then connecting thru that network. When you connect thru a network device ANY unencrypted traffic (POP or SMTP not using ssl/tls?) whoever setup that access point can collect your Username and passwords.
Turn the auto-join function off (which is hidden way down in the settings):
On Android
If you are connecting thru SSL, there is at least some protection but if you're getting SSL errors...there's a reason. You aren't connecting to who you think you are and those ID/passwords are being intercepted too.