So just learnt that Cloudflare "email protection" is a thing (https://mstdn.io/cdn-cgi/l/email-protection).
Additionally, Cloudflare thinks Mastodon IDs are email addresses: so if you have Javascript disabled, you might find that instead of Mastodon IDs you only get to see `[email.protected]` everywhere. Thanks, Cloudflare, for going far and beyond your duties of serving pages given to you, for the sake of our "protection"!