properly salted hashs can still harm many peple. You could still run a brute force on the top 10k most common passwords and with ~150m averge computer users, you're going to get a few. And you have their email address. There's a good chance they're using the same password for email. Now you have their email.