Depending on the jurisdiction, what you are doing may be illegal nonetheless, even if that is "your own account". Technically, what you do is an online dictionary attack, so it entails a lot of connections to the target server, which hardly is "normal and fair usage" of the resources of that server. You have an account on that server based on the tacit (or explicit) acceptance of some usage rules, that your attack attempt breaks. To make an analogy: if you rent a safe box in a bank, then bring to the bank an industrial driller and begin to pierce the safe door, the banks may call the cops, even if that is "your" safe box.
Therefore caution is advisable. To make tests without incurring any legal inconvenience, I suggest that you run your own server as a virtual machine on your own PC.
In any case, what THC-HYDRA does is that it submits potential login+password pairs to a given Web server through POST requests -- and it must be able to determine whether the attempt succeeded or failed. At the HTTP level, the response code will always be a 200 (an "OK" code)(that's the whole difference between "HTTP Basic Authentication" and "HTTP form-based authentication"); the tool must somehow "understand" the returned Web page, which necessarily entails some heuristic analysis (the Web page which says "sorry, bad password" is meant for a human being, not for a machine). I suppose that whatever heuristics are applied by default by Hydra do not work well (or at all) for the site you are targeting. Maybe after a dozen attempts, the site returns another error page (no longer "sorry, bad password" but something like "begone, evil hacker !") which is misinterpreted by Hydra into a success report. This would explain what you observe (wrong passwords returned).
If the dialog with the server uses plain HTTP (not HTTPS), then you can observe the requests and responses with a network monitor tool like Wireshark. Otherwise, refer to the Hydra documentation to see how to configure it for response recognition.