This is not hard to determine. E-mail messages have headers, and the app will send registration e-mail to the cloaked address. So all it takes is scanning the e-mail headers of stored mail.