I ran into this too. The workaround I ended up with is making an extra dummy AD account for each affected user, and on the dummy account I set the UPN suffix to the same as the email domain so the full UPN ("User logon name" text box plus dropdown box on the Account tab in the user's properties in Active Directory Users and Computers) is the same as the user's email address. The user's real AD account needs a UPN suffix that's different from the email domain (in our case the UPN suffix for the users' real AD accounts is similar to something.example.com and the email domain is example.com).

Then I made up a pre-Windows 2000 logon name (I just prefixed their real username with an e, for email). I made up a random long password for it and disabled the account ("Account is disabled" in the "Account options" box). The pre-Windows 2000 logon name can be pretty much anything that isn't otherwise in use, doesn't matter much since nobody will actually be using it, but you have to enter something.

It looks like this dummy account will be attempted instead of the real one (I guess since it is an exact match) and the real AD account doesn't get bothered anymore. Kind of messy but it seems to get the job done.

You might have to add the UPN suffix that matches the email domain in Active Directory Domains and Trusts -> Right click Active Directory Domains and Trusts -> Properties -> UPN Suffixes, if you don't already have it available in the user properties in Active Directory Users and Computers.