subject: using a custom query to harvest email addresses

From ticket:153#comment:93
> Again, if you discover any leak of e-mails information remaining for unauthorized users, please create a new ticket.

A malicious user with a little motivation could easily harvest 100's of email addresses from Trac.   This can be achieved through custom queries on user-fields, using popular domain names as search criteria.

Example:
[http://trac.edgewall.org/query?reporter=~%40hotmail.com&col=id&col=reporter&order=priority hotmail.com]

By replacing "..." with the domain name in question, full email addresses can be collected from the query results by unauthorized users.