not a huge deal for internal/workspace stuff because it looks like you can get a user's ID from their email with a workspace API (even without them OAuth granting permission)