Looking up users by an email address is necessary for e.g. authentication mediator to work.
This does not pose any greater privacy or security risk than the currently available APIs, since they already allow finding a user by their email address, albeit much slower (list all users, iterate over users, request emails; possible to optimise by first checking users with usernames similar to their email addresses).
