[icebraining]

But then how can they know where to send the email to?

[maouida]

They have the email (confirmed email) in their DB. they can easily calculate the hash on the fly.