If you want to email someone, you need their email address. There is no way around this. And yes, that means that the business needs to store email addresses securely so that hackers can't harvest their database of customer email addresses and spam them. This is good.

Usernames can be whatever the user likes, unless there is a good reason for them to give their actual name. In which case, there is a good reason for them to give their actual name. And then the business has a responsibility to store the user's actual name securely, etc. This is good.

There is no good reason for anyone to store passwords in plain text. Fining people who do this is good.