Anyone with access to the sql database can see it.
It would be different in every instance. Generally the instance “owner” as I would call it. But also and developer that may have been given access.
People assume it’s admin. But as far as I can see, on my admin profile, I have no access to that data.
if your worried getting spammed with emails, i’d suggest using an email relay in your Lemmy account instead of using your primary email add. Here is an example - https://relay.firefox.com/
What about messages? Where do they live and can they be seen by anyone?
Support question, please see rule #3 and !lemmy_support@lemmy.ml