Well the typical problem is people use the same password/email for various websites. I strongly suggest you store the password as a sha256 string (and not the original password). The old crypt routine is rather weak and from a security perspective considered 'broken'. Emails - well that's up to you - I can see the convience of it but whatever...
Oh - and you should use ssl for passwords. This in itself is not totally safe because if the fansite is hacked and an trojan installed they can still capture the plain-text password before the match but it would be a step in the right direction.
