The problem is that there are many email addresses that are valid but are likely just abusers. An email address entirely of * and 200 chars long is valid in the RFC, but clearly not a human.

I settled on < 100 chars and:

`^[\w\.\+\-]+@[\w\-]+\.[\w\-\.]+$`

We'll see how it goes in production :)