If you are talking about a project with a single maintainer, why is not OK to search for emails in the commit logs?

For a small project I think it's perfectly fine if you feel this DOS attack is a legitimate concern.