1. Prevent a malicious user from setting up a survey with only one other person's email address. 2. Ensure that everyone knows the full group that is being surveyed by including the list in the email (so that they can not worry about #1)

I can definitely see the value in being able to post a link somewhere and have people be able to just follow it to report.

Got any suggestions on how to deal with or mitigate the exploitation of the system in that manner?

I also can now see the downside in having everyone's email on the list. It makes it feel less anonymous. Seems like you have to trade one for the other. True anonymity and ensuring salary data doesn't leak.