email? Is a user's email up for grabs just like that?