[kevinator]

OK, more info: we’re completely integrated with WordPress. Our username for login is the user’s email address. Even when a visitor is not logged in, they can click on another user’s profile and view that user’s email address. Problem.