Email addresses aren’t usually secret though. If an employer happens to know the personal emails of a large fraction of its workers, it isn’t going to be meaningfully slowed down by a hash. 1M addresses * 1 second/address = ~12 days (and in practice a lot less since hashing is nearly trivial to parallelize)