I'm honestly not sure how your email address would be leaked, vanity URLs are name-based and at least one of the reasons Plus uses ID strings was in order to prevent leaking any account details through the URL. I'm sorry that other people are figuring it out, that sucks. If you remember what happened and think that G+ has had a hand in the leakage, please feel free to ping me (my URL is in my profile) and I'll try to follow it up.

Personally I do feel that G+ has done a good job at communicating to users the privacy they do and don't have, as the ACLs were baked in at the beginning. I think users have had the possibility to be confused when data is being used outside the http://plus.google.com domain, like Shared Endorsements and the YouTube comments, as this opens up the worry ACLs are being violated. I think there's more work that can be done to communicate that this hasn't happened, such as putting the "Shared (publicly|privately)" on YouTube comments so you can see why those are there.