Maybe we should do something about this?
Hmm, true - it should be obfuscated in the note mails also:
"There is no need to obfuscate your email address, as we have a simple conversion in place to convert the @ signs and dots in your address. You may still want to include a part in the email address only understandable by humans, to make it spam protected, as our conversion can be performed the other way too. You may submit your email address as user@NOSPAM.example.com for example (which will be displayed as user at NOSPAM dot example dot com. Although note that we can only inform you of the removal of your note, if you use your real email address."
- http://www.php.net/manual/add-note.php
However it is impossible (I guess?) to obfuscate the address everywhere, since you would otherwise not be able to send a "rejection notice" to the person. Maybe some kind of encode/decode thingie would do the trick :)
I have committed a fix, which should safely(?) print email addresses (at least the way they are printed on the site when provided without obfuscation.
Goba