The three big ones are [1] if you have a work in an anon collection, and someone else adds that work to a collection, that someone else sees your name on the fic, [2] if you as an exchange moderator assign someone as a writer, and then use the write-in field to write in a second giver to that recip, both writers can see each others' email addresses, and [3] since collection mods see email addresses (fine, ish, at least in the sense that you agree to that when you sign up for an exchange), it's very easy for people to create a gift exchange collection, assign someone random a pinch hit, and get their email address.

They're committed but not deployed a fix for the anon collection thing, but only after a solid week of wank on meme after someone used the exploit to reveal the author of a really racist fic in a high-profile exchange.

...That's an incredible story about the early beta. I kinda wish I was more surprised, but that seems about exactly what I expect from AO3.