Sending email via memberlist.php was limited to users having u_sendemail. When board_email_form is disabled, no such requirement was enforced. This is now changed. PHPBB3-9772