We wouldn't be exposing anything if the email was added to the url:
```php
elgg_get_site_url() . "uservalidationbyemail/emailsent?email={$user->email}"
```