p.s. under GDPR an email address *is* considered personal information and should be treated as sensitive. Although I'd presumably already have that info if I'd spotted a mail flying by with a password in it