"And each user's email is unique too." - how to you handle untrustworthy third parties then?