API method which allowed to enumerate emails at https://api.my.games/ was not sufficiently protected.