Function mask_email 

pub(crate) fn mask_email(email: &str) -> String

Keeps the domain and drops the local part: enough to recognise which mailbox to open, not a new disclosure of an address. Teachers get the same masking; only admins see an address in full.