People share passwords, and use e-mail address to create accounts on all kinds of websites.

Anything that would prevent the website's server from getting the plaintext password would be good. Salted hash is obviously not a plaintext password and can't be stuffed around to other services.