List of user email addresses compromised

[Ian]

I registered here back in 2012 and haven't used the email address for anything else. It isn't (shouldn't be) visible to non-mods here either.

Today I get a 'I hacked the webcam you haven't got' attempted blackmail spam to that address, the first thing it's had in about six years.

I don't know what else is compromised here, but the email addresses of users very probably are.

It was a unique password used here too, but I'm still off to see how phpBB stores them...

[fantastory]

That is true, email address is seen when you hover on user name on his profile page.
There is an option to show email only to friends but it is off by default.

The quickfix would be to mark this field for all current players and making this option default.