The GDPR does not regulate specific security measures beyond making recommendations about what you should considder.
It requires you to evalute risks and, if necessary, implement security measures to mitigate those risks. Doing a DPIA (Data Protection Impact Assessment) to identify levels of risk may be helpful.
To do a DPIA, one obviously need to know the website and what personal data it process. Only you can do that.
As an example, I would say that if you run a website for sharing cupcake recipes, you probably would not need to encrypt the emails. If, on the other hand, you run a website were AIDS-patients share experiences, exposing a user's email address to a third part would be very harmful to the individual, and you should probably implement additional layers of security, such as encryption.