I appreciate the time and effort you've put into catching bugs and making this report. Thank you @arhag.
I think that the service should never, under any condition expose emails or telegram handles, except for the first and last character. This means that the user would have to re-enter their email/telegram with each setting change. This minor inconvenience however is well worth the privacy.