Right, that recovery trade-off is exactly the bet I made. Sherlock uses email at signup specifically so there IS a "forgot password" path. With just an ID and password, one forgotten password means the account is gone for good - and for the non-technical people I'm partly building this for, that's a real-world dealbreaker. So I traded a bit of privacy (email is still an identifier, I know this crowd isn't thrilled about that) for recoverability, on purpose - not something I overlooked.
The fully ID-only + optional 2FA route is cleaner on privacy, no argument. I keep going back and forth on whether to offer both and let the user pick: maximum privacy with no recovery, or a recovery channel at the cost of an identifier.
And good point on WhatsApp - contact discovery is genuinely why it spread, even though it's also its most privacy-hostile part. Replacing that growth mechanism without rebuilding the privacy hole is one of the harder problems, and I don't have it fully solved.