Have there been any instances of malware or spyware packaged in custom ROMs, for example a malicious email app pre-installed that records your server IMAP username and password and forwards it to a 3rd part? Or part of the kernel that takes periodic photos? With regard to custom ROMs, I mean official and unofficial releases such as Cyanogenmod, AOKP, LiquidSmooth, etc.
Not in any of the popular ones as far as I've heard. But you're free to build one yourself, which would then mean that it has happened.