You can hide the email via CSS, but someone could still view it via browser dev tools. To fully hide it you’re likely going to need to build a plugin.
That said, if your users are able to be compromised on your main site, I think you have bigger issues than their email being revealed.