Jerry,
your point is very good. Google for example indexes the profile pages so they are already going around it. check:
Googles searching for my name. The third or forth appeareance is the openacs profile.
One way would be to warn the administrator that emails have been left to the open. Maybe then by default turn on the internal mail form
