The e-mail addresses are hidden. Spammers pick them off sites. If you click on the "e-mail" button, you can send an e-mail to the person's account. Check the box "send a copy to yourself" and you can see what it looks like but still can't see the address in the clear. Then, when that person responds via e-mail, you'll have the address in your e-mail account, which is presumably secure, and you can then send attachments up to the capacity of their system and yours!!
Cumbersome maybe but safer than having addresses "in the clear". As for the outbox vs the sent box, I think Pat's guess is right, once it's read by the recipient, it moves from out to sent...If that's the case, better nomenclature might be delivered and read....I think this is a function of the php system though, best just to live with it once we understand it. It's nice to have both PM and e-mail options!!
I'm sure the nerds will weigh in with an explanation that maybe 10% of us (me not included) will understand...
Charlie