stop backfilling from emails, it allows spoofing via unverified github address

fixes #492