One real email field. Every other email field is a trap that a malicious page could use to collect extra data — none may be filled.