Brian's comment did point this out, already:

"Optout contains email and course_id. Is there a reason for using email instead of user_id? In particular, a user can change an email address. Do we want to store created/modified times on this model, or are we relying on logging to track changes? (I think Piotr pointed out the lack of tracking logs -- maybe that is enough.)"