I did it because I trusted the JREF & was donating. I changed a day ago, but there is no way for me to tell if it is is still not saved somewhere in the forum DB (as in "original email address used for registration" or soem other fields). Otherwise I would have used the crap email addy I am normally using for everybody else.
From a software point of view there's no "original email" address field in the database for vBulletin that I am aware of.
Depending on how it is configured the forum software may send out new user registration emails, in which case your original email address would be in that email if it's stored in an email box somewhere.
You're not only trusting the JREF, you're trusting the server that the JREF is using, you're trusting the company where the server is located (which means you're trusting all the admins that have access that way), you're trusting the internet providers for the hosting company, plus you're trusting all the people who have access to any of hardware between you and the JREF server, since all those people would, in theory, have access to any information sent to the JREF server (including your actual password).
ETA: heck everything I remove or change I cannot be sure if it is really removed.
That's true of everything you don't do completely by yourself.
It's like security for your house, there's no such thing as real security. If someone really wants into my house, they'll get in. Do I care if they steal my dishes? Not really. But if I have something I want to secure more I have a bolt down safe or store it offsite.
Same with the forum, if someone with enough resources really wants to get the info they'll get it; god tier security requires god tier money. Any site can only take the appropriate level of precautions given the risk and budget.
If someone gets my real name from the forum, meh. If my real name was so important to me that losing control of it would do real serious harm to me then I would not trust it to the level of security a forum like this could provide.