To copy over the discussion from hipchat: we kept optouts by email address because we were pre-planning for sending "marketing" emails which may not have an associated user, so those optouts have to have email addr as a parameter.  We had hoped to unify the two types of optouts.

Still I think the fact that this breaks if the user changes their email address is enough of a deficiency that we should just keep 2 types of optouts: associated with a user and associated with an email address.