Oooh, that’s going to be a tough one.
Currently, when an admin or moderator views the email of an account, it is logged, except if an admin takes a backup and reads the email from there. So there’s a layer of protection against rogue employees, but it’s not foolproof.
SQL injection - Discourse has never had a SQL injection vulnerability, and I don’t think it ever will. There was one in Rails that got patched, but Discourse was never going to trigger it. What you need to be worried about is someone getting XSS on an admin and using that to extract sensitive data.
It sounds to me like you need encryption-at-rest of the emails, plus disabling the ability to Show Email or search users by email.
This also shares aspects with needs from medical organizations of anonymity of user accounts.