Grrr, Cloudflare is so annoying with its "protected email" every time there's anything with an @ sign in it.
In this case I'm using Lynx, so there's no Javascript allowed ever. But I also see it on random sites in Firefox with NoScript enabled, and Cloudflare will hide things that aren't email addresses, too—not just Mastodon usernames, but even version strings for software, e.g. "some-lib@1.0.4"