Ha! Wondered if anyone would spot that 🙂 Yes, using an unsalted MD5 is almost as bad as using the plain email address.