You're right. That's what's happening.

I was doing something silly earlier where I was passing the email in through a hidden field rather than in the session which left it open to manipulation. Which is why I did this as a security measure but that's not necessary anymore. I'll change what this does.