It's pretty insecure. Beyond the obvious "I know both people and their emails and that they use this service" it would be trivial to do company email attacks (I

It's pretty insecure. Beyond the obvious "I know both people and their emails and that they use this service" it would be trivial to do company email attacks (IE: all employees use (first-initial)(last-name)@(companyname).com so if I have a list of employees I can quickly access all combinations of those employees). No idea what your service is about and if that level of security matters.