You could always ask users for their email address at sign-up, send them a random, single-use, account recovery code, and then never store their address.