I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing both in one email?
If there is, it would be industry-specific. For example, the laws regulating nuclear reactors may be different from the ones regulating flower shops. As far as I know, there is no general federal law in the United States prohibiting you from sending credentials over email, even in the same message.
Personally, any system that requires a password from an end-user should have a method of setting/re-setting that password without the need to send anything to the user, such as the user selecting a password upon registration, and then being able to reset and choose another password, preferably by confirming other details that were setup during registration such as secret questions etc. This would ensure that if someone wanted to get at the password, they would either need to compromise the system (hash/salt anyone?) or compromise the users machine or network.
No - there is no law against it, but sending the two at once effectively gives the recipient of that email, or anyone who intercepts it, access.
By separating them, an attacker will need to intercept two messages, and if the two are sent by different media (eg an email and an SMS message) the attacker has an even more difficult task.