Someone at work joked, “maybe only for certain websites people wouldn’t want others knowing they’ve signed up for!” ;)

Anyway, I’ve always tried to steer away from this, but designers seem to love the UX of morphing a universal login or signup flow from one to the other based on prior activity. However, this makes that info public and potentially scrapable/vulnerable.

Besides rate-limiting or emailing them a link to login, is this considered OK in 2018? Is it permissible to expose emails registered without verification under GDPR?