It is possible to do any number of weird things that practically nobody in the whole world, including companies with the best security teams in the world, actually do. Tokenizing email address is indeed one of those weird things.

What is that going to do, the outcome is the attacker still has the password hash and the linked email address?

So how do they log in without a username & password ?

To your site, they probably don't. But they'll take the email and password and use it elsewhere. You'll have still exposed your customers.