It could be that they're taking advantage of a third-party service that he's signed up for. For example, Google Docs used to show a user's email when they clicked a link to a document that you created (it's anonymised now)