The anti-enumeration guard required @ in the email prefix, causing the typeahead to silently return nothing until the user typed @. Replace with a minimum 3-character length check to match the frontend trigger condition.