It's pretty insecure. Beyond the obvious "I know both people and their emails and that they use this service" it would be trivial to do company email attacks (IE: all employees use (first-initial)(last-name)@(companyname).com so if I have a list of employees I can quickly access all combinations of those employees).

No idea what your service is about and if that level of security matters.