Well, a lot of user use the same passwords everywhere; so if you got ahold of SiteA's md5 hash of a user password, their email is out the window...
I'm not saying how you'd get this, as I have nada clue, I'm simply stating that just relying on MD5 as your only security on passwords you're not doing too good of a job... Most other solutions (going off of a convo "elsewhere") do more than a simple md5($password), they go as far as md5(md5($salt . $password . $pepper))
