Yes, this is an issue and we are aware of it. With full permission Actor it is possible to fetch user's email. This is now much less concern since most Actors are limited permissions and full permissions require manual consent and are hard to use from agents.