Note: …the complete list of IDs shouldn't be exposed externally, because spammers will use the list for their mail bombing. This is an entry point for phishing attacks Perhaps you should require at least two letters on any directory lookup, so the spammer will have to do 26*26 lookups instead of only 26 (if you require 1) or 1.
{}