You could also use a hash of the email so that you don't retain and can't reconstruct the original address. Then the recovery process can look for a valid acco

You could also use a hash of the email so that you don't retain and can't reconstruct the original address. Then the recovery process can look for a valid account based on the provided email's hash, and if one is found, a recovery email can be sent to the provided address. Include an expiring, one-time-use token in the recovery link so you can immediately forget the address again.