Both an email-address and a domain name have a use-after-free risk. Doubly so if an expired domain issued email-addresses to users