Ah true, in the past I have hashed emails with no salt to try and provide some privacy. For password reset I just asked the user for their email when requesting

Ah true, in the past I have hashed emails with no salt to try and provide some privacy. For password reset I just asked the user for their email when requesting the reset and tested against the hash to make sure its legit.