If the user is already setting a password in the app, couldn't the app just ask for the user's email address? It doesn't seem like having the email address for free really buys a malicious developer that much.
I was in a store one day when the clerk asked the customer for their postcode, the customer went nuts saying that he shouldn't have to tell them. Three minutes of arguing could have been shortened to "INSERT FAKE NUMBER" if he was really that against giving his real post code.