Upon a password reset submit, check if the hash(email_submit) exists, if so, email the password reset instructions to the email_submit address :)

Still, notifications would be toast.

Thought most email notifications are annoying, they can be useful (or crucial).

If you don't need email notifications, then it's not a problem.

One nice feature from gmail/yahoo/outlook/etc.: temporary email addresses that forward to your email. This would solve the problem.

Or, maybe alternative notification methods are preferred? If they wanted, a user can input an email address with a plus (if they're using gmail) and then receive notifications only on that. If the user wanted, then they could block all incoming messages that match that generated email.

Why is encrypting pointless if you generate the equivalent of a private key in code? Of course, if the attacker also gets the code, then you're toast, but getting the code is not guaranteed. So, seems like you'd have some additional protection with encryption.