Keeping the typed address for mail and using the normalised key only for matching is the detail that's easy to skip. The Workspace caveat is a good one too, since j.smith and jsmith can be two different colleagues there. How do you handle a real second person whose address collides with an existing key?