When not logged in, the users collections is still published to the client with all details, which means, that all email addresses, real names and roles are visible on the client:

One such message on the DDP:

a["{\"msg\":\"added\",\"collection\":\"users\",\"id\":\"KZsNMd7AC5kcu5yLj\",\"fields\":{\"emails\":[{\"address\":\"real.name@email.de\",\"verified\":true,\"fromLDAP\":true}],\"profile\":{\"name\":\"Real Name\"},\"roles\":{\"5zJmLcj4mCeuH86mZ\":[\"10\"]},\"username\":\"userid\"}}"]

For details see the Chrome Developer network view of the DDP websocket: F12 -> Network -> "websocket" -> Frames