I work in marketing, had an issue the other day someone did something weird by browsing our site with a personal email address and worked out the naming conventions we use to jump the sign up form for an in-person event and went straight to the thank-you page to get the details.
So then we had his personal email (which we didn’t want!) and had to connect it to his work email in the CRM to connect his profile.
So, for the general use cases it would work, but someone that is trying to connect the dots probably could.