The tab has no impact on the access of the auto action itself. So someone just needs to know its URL which any user can get from their own profile and replace the user id in the URL to email themselves other users data. That'd be a privacy/security issue. You should really have the OR condition explained above to explicitly limit to to moderators and user self.