I am not a lawyer, and the world is a large place with many conflicting laws, so I can't say anything about the legality of using cURL...
But from a technical standpoint, anything that you can do to their server with cURL, you can also do with a web browser. Anything that you can do to their server with a web browser, you can also do with cURL. They are simply programs that follow the HTTP protocol.
Of course, you can commit crimes with browsers, so it's possible to use cURL to commit crimes as well, but just the fact that you used cURL does not turn non-criminal browsing into a criminal act, unless the countries involved have some very specific laws.
To your specific point, if there is any crime in submitting data to a form on an insecure website 100 times in a row, then it shouldn't matter if you used cURL or if you just copy/pasted the information into the form and hit the submit button in the browser 100 times.