Good catch on the security exposure.

I'm tempted to just disallow passing both a token and an email to this call, rather than trying to define the behavior if both are provided. The caller probably knows better than we do what they'd want to do if they have both pieces of data (which might not point to the same user).