On the topic of tracking emails that are "publicly posted on the web", how are you then making sure that the emails have been published with consent and don't originate in sources like database dumps etc.? As it does still sound somewhat unethical to use emails that aren't published with consent.