use correct from address
wrong email or validation code message
obfuscate email display and authenticate display of user list