This will solve the issue, Bounty hunter should not use there personal email when joining in bounty campaign. Always expect the worst that there details will be exposed in public.

Bounty manager submit all the spreadsheet information to the project owner so even though they hide it. Project owner will see it and they are the one that selling or giving away user email to other project to have initial user for them.