I'm trying to understand the implications here. Is the author suggesting that real world attack would involve randomly generating email addresses to see if they are valid or not based on whether they might match the current user. Or would the attack involve purchasing a list known email addresses from spammers, and then doing lookup against that list for every visitor that comes to your website?

Option 1 seems like it would take impossibly long to match, and I'm not sure what actionable information you get from option 2, other then maybe verifying that the email address is still active?