Use API to get mail address for given username

[riking (Kane York)]

The point of that being non-GET is that it causes a staff action log, so it shouldn’t be triggereable from an img or an idempotent request retry thing.