warn user about exposing email address when creating message

This warning was lost in 54b8d359d.

There was some discussion about whether exposing the email address is necessary in the first place. The alternative would be to link to the users "send message" form (`/user/{username}/message/new`). This would be a consequent thing to do as we have removed a lot of email specific functionality since #615.  (see also #869, especially 2af6121)