This leaks some information about the user's email address. If you suspect one of your users is (say) "jean@example.com", you can email jean@example.com. Then,

This leaks some information about the user's email address. If you suspect one of your users is (say) "jean@example.com", you can email jean@example.com. Then, call notifyOnEmail({from: "login@passwordless.example.com", to: "jean@example.com"}) in every session on your site. If Jean happened to be logged in, you've just identified her. Spam filters would probably stop you brute-forcing the address of every visitor, but they might not help if you already have a good guess. Requiring user approval will stop most of this, although it won't block queries like "are jean@example.com and j@example.net the same person?".