md5 hashing emails - that's dumb, right?

[epixoip]

In this context (assuming the donors or beneficiaries or whomever are intended to be kept confidential) it is dumb to use MD5, yes. They should be trivial to crack.

You wouldn't use a mask. You'd either do a combinator attack or use rules to append domain names.