Yes, the incremental attack works of course, I guess I've been misunderstanding, I was assuming Bob wasn't making e-mail information available at all ...
Whenever information is made public there's surely a risk of folks abusing that public information.
Maybe we should add code to pages like this that could optionally be set to refuse to show someone more than a set number of e-mail addresses per day, that kind of thing?