Hmmm. . . more testing shows that whether I enter just {email} or {if(email,"{email}"," ")} in the Simple Plugins | plugin updateTokenByResponse | "attribute_2 updated with" field

A value like the following is actually being sent - it may not be showing up in the attribute_X field holder in the CPD table, but an API captures this information that looks like this:

{{72938717__attribute_2}}

I'm trying to avoid sending this kind of information over an API unless it is an email address.