JIRA has a new general configuration option, whereby user email addresses can be public, hidden, masked, or shown only to logged-in users. The 'masked' option is currently fairly useless as a spam prevention measure, since only the human-visible part is masked. So one might have <a href="mailto:joe@example.com">joe at example dot com</a>.