The reason they do this is because otherwise they block the requests.
I'm not sure what the issue is with publishing your email address in principle, you are reaching out, you want to inquire about some business. If anything use a different address. But why would you asymmetrically expect businesses with websites to bend over to give you all the advantages, they need some assurances as well.
Anonimity usually works one way, one party can be anonymous, not both, if you come from consumer land, it's the companies exposing themselves and doing all the compliance, if you choose privacy and force the companies to expose themselves, you'll get your wish granted, but there will be a cost, it's unlikely you'll be in the more advantageous position.
I must defend Anthropic. It is normal to tell every website who (email) and why (session slug) you are looking at a page they publish. The visited website has to be reassured for all the compliance they have to do and how they expose themselves. If scammers use that against you, just change your account address on anthropic's product. You must assume everything you give them will be leaked. Probably should even use a separate payment method uniquely for that. The era when you could just read a web page is bygone. Website holsters can't keep keep giving website browsers all the advantageous positions without a cost. Good thing anthropic already made the correct decision here, once again, as always. Amen.
As implemented, it strongly violates the principle of least surprise (assuming this is true).
A more sane implementation of this would involve a prompt the first time an agent attempts to connect to each of the sites that Anthropic thinks it necessary to send this email header to, asking if this is OK (and bailing on all requests to that domain if the prompt was rejected).