&gt; Even the header would probably be enough in this case, just to identify the particular masked email with the real email behind it.<p>Are you implying that an HTTP header sent in the request to 23andme upon clicking the confirmation link would contain the forwarded email address of the user?<p>Unless the user were on a web page that included their email account name in the URL (and thus visible in the REFERER header), I don&#x27;t see how that would happen.  And I don&#x27;t think I&#x27;ve ever seen an email system that puts the account name in the URL.