The payment processo also leaves ID trace and IP leaks, eg alby.
Email is IP aware and hard to secure, even with VPN. Throw away ones are not useful long term.
Discussion
The biggest security hole is definitely that it's account based so all your queries could theoretically be tied to that single account if they're not being honest.