That is where a token or key comes into action. Since you do not want user A to be able to see the email address of user B, you can use a token or User ID of the user B to get the email address.
(Off-topic, but still) In ASP.NET (perhaps you are using the
ASP.NET Identity) you have the ability to get the details of a user based on his ID. You can use this ID to allow user A to contact user B while having his actual email address hidden in your database. Then, upon submit request, you should
use that ID and get the email address of user B and send the email to him.
For more on ASP.NET, please use their forums. This is forum related to
Visual C# only.
The sh*t I complain about It's like there ain't a cloud in the sky and it's raining out - Eminem