Adalo has this out the box warning. I expect it only works on their native user signup form. Not custom form.
In a custom form you risk exposing the email addresses of all users, as you have seen. Can you make do with the Adalo form?