> "the user can enter their email address”

That only defines one of the things the user can enter. Should they be allowed to enter their postal address? Maybe. Should they be allowed to enter their friend's email address? Maybe.

Your acceptance criteria is too shy of details.