A good spot .
Here's my experience, which is somewhat different from what the OP describes: I have multiple accounts which I top up, all linked to my email address, although some are for people who live far away from me.
On checking my emails (and bearing in mind that for my account I have the option to receive email from giffgaff disabled so don't receive anything for essie112mm) for usage statements only the username is mentioned. The same applies to other email, for example one which I received asking for feedback about an idea on Labs for managing multiple accounts: only the username shows.
However, when purchasing goodybags the username and mobile number are shown in full. Now, here's the interesting bit: for a credit top-up the username and mobile number are given, but with the first 4 digits shown as xxxx. So, clearly, giffgaff does on occasion already apply this practice.
giffgaff is not alone in using the full phone number. Only last night I placed an order with a very reputable company and
the confirmation email included both my address and a mobile number (which was actually fictitious - Ofcom has a number of these). I never supply my real number to anyone unless I know that I am going to receive a text about the delivery.
On a side note, it's probably not helpful to use @mentions so much as staff don't respond that often and repeated use just kills off their interest even more. Also, this topic is not Will's domain (he's "recognition and rewards") and Alex deals with the community platform and payback. Amy, I notice, has already not responded to your tag twice but perhaps you might get her notice more if you post in her thread about revamping an email for new joiners. She could then pass on the anomalies and concern to the appropriate member of the team.