Hash user emails in database?

Hashing is a one-way function, meaning you can’t get back an original string from a hash value.

You could use the PHP function mcrypt_encrypt to “encrypt” the email address and mcrypt_decrypt to convert it back.

If you went that route, you could hook into password_reset to decode the email address before the password reset is sent, and then hook into password_reset_after to encode it again after.