I'm leaning more and more towards treating the email address that you use to register for business-critical services as secret.

It's a level of security-through-obscurity, yes, but that doesn't mean it's wrong. It means you can keep that address monitored well. You could make any activity on it send a page, for example.