Only if in possession of the email address or domain name.
Where an email address or domain name has been taken over by someone else, then sending the results to the email address instead of currently showing it on the webpage doesnt solve the problem. This data set is ripe for blackmailers, intelligence services and any company looking for intelligence on rival businesses.
...if the password for said email address is already visible on the same page (assuming negligent password reuse) what kind of verification could you hope for?
