A two step process seems like more effort than different email addresses per user. Thankfully you can use the from header as long as addresses are suitably uniq

A two step process seems like more effort than different email addresses per user. Thankfully you can use the from header as long as addresses are suitably unique (hey, it works for flickr, wordpress and countless other sites that host much more sensitive data, why not yours?) Assign each user an email address that's based on (and I'm sure the likes of cperciva or tptacek can improve on this) an email friendly encoding of an scrypt or bcrypt derived function to generate a unique email address. This can then be added to the user's address book under an alias for your service. You then store this value and the username in your app. When the email is received, you look up the unique source address and translate it to the user. Problem solved.