Joshua has broken the ToS of Discuss because he has access to the tool and got an email address that belongs to Francesca. He used a privileged access to obtain her PII. Under the GDPR that is simply illegal. In Western Europe his behavior could take him to a court.

This is a site where we discuss about privacy in technology, and this is an example of how people with privileged access to PII should follow the higher standards, no matter how disgusting are the opinions, like the ones from Francesca.