Comment 15 for bug 498181

This is an interesting workflow. I hope we can make this work well.

HIdden email address can be seen and used by the Launchpad admins only. Registry Admins can see hidden email addresses on the user's profile page, but cannot use them (we get errors trying to access them in scripts). In the case of Contact-the-user, the person who is sending the message is choosing to reveal his address to the other person. The person who receives the message may also have a hidden address, and he must decide how to reply--he could reveal his email address, or reply from another email address, or use Contact-this-user.

In the case of joining a team, the team admins and the user get separate emails because their actions are different. PROPOSED means that the admins get an email to approve the proosed user. Yhe user has no idea he is now proposed because the pupose of PROPSED is intended for the user. Since the mailing code "knows" that the user doing the PROPOSING can see his own address there are no security checks. We could add a security check to the email code because the users are getting separate emails--the team admins will not see this PROPOSED user's email address.

The question is should we allow this inverted process. Someone could use it to add me to a thousand team. That would be very bad for me.