Requiring an email address with each post was a config error on my part. But there used to be a blind email link that allowed users to send a email to an author through a form -- that seems to be gone.

Bots can get at that because the email is never displayed in the html.