diff --git a/app/Http/Controllers/AdminUserCleanupController.php b/app/Http/Controllers/AdminUserCleanupController.php
index 895dbadf..4c26796c 100644
--- a/app/Http/Controllers/AdminUserCleanupController.php
+++ b/app/Http/Controllers/AdminUserCleanupController.php
@@ -5,6 +5,7 @@ namespace App\Http\Controllers;
 use App\Models\ShoppingUser;
 use App\Models\ShoppingUserMemberLog;
 use App\Models\UserCleanUpLog;
+use App\Services\UserUtil;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
@@ -137,7 +138,7 @@ class AdminUserCleanupController extends Controller
 
                 // Restore-Button für gelöschte User
                 if ($user->pre_deleted_at) {
-                    $html .= ' <button class="btn btn-sm btn-success" data-toggle="modal" data-target="#modal-restore-user" data-id="'.$user->id.'" data-email="'.str_replace('delete-', '', $user->email).'" title="Wiederherstellen"><i class="fa fa-undo"></i></button>';
+                    $html .= ' <button class="btn btn-sm btn-success" data-toggle="modal" data-target="#modal-restore-user" data-id="'.$user->id.'" data-email="'.UserUtil::stripDeletePrefix($user->email).'" title="Wiederherstellen"><i class="fa fa-undo"></i></button>';
                 }
 
                 return $html;
diff --git a/tests/Feature/UserDeleteEmailPrefixTest.php b/tests/Feature/UserDeleteEmailPrefixTest.php
new file mode 100644
index 00000000..8440ff9e
--- /dev/null
+++ b/tests/Feature/UserDeleteEmailPrefixTest.php
@@ -0,0 +1,53 @@
+<?php
+
+use App\Services\UserUtil;
+use App\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+function makeDeletableUser(string $email): User
+{
+    return User::forceCreate([
+        'email' => $email,
+        'password' => bcrypt('secret'),
+        'lang' => 'de',
+    ]);
+}
+
+it('pseudonymises the email with the user id so a second deletion does not collide', function () {
+    $first = makeDeletableUser('lena.oetjen@googlemail.com');
+    UserUtil::deleteUser($first);
+
+    $second = makeDeletableUser('lena.oetjen@googlemail.com');
+    UserUtil::deleteUser($second);
+
+    expect($first->fresh()->email)->toBe('delete-'.$first->id.'-lena.oetjen@googlemail.com')
+        ->and($second->fresh()->email)->toBe('delete-'.$second->id.'-lena.oetjen@googlemail.com');
+});
+
+it('restores the original address from both prefix formats', function () {
+    expect(UserUtil::stripDeletePrefix('delete-1212-lena.oetjen@googlemail.com'))
+        ->toBe('lena.oetjen@googlemail.com')
+        ->and(UserUtil::stripDeletePrefix('delete-lena.oetjen@googlemail.com'))
+        ->toBe('lena.oetjen@googlemail.com')
+        ->and(UserUtil::stripDeletePrefix('lena.oetjen@googlemail.com'))
+        ->toBe('lena.oetjen@googlemail.com')
+        ->and(UserUtil::stripDeletePrefix(null))->toBe('');
+});
+
+it('does not double the prefix when a deleted user is deleted again', function () {
+    $user = makeDeletableUser('doppelt@example.com');
+    UserUtil::deleteUser($user);
+    UserUtil::deleteUser($user->fresh());
+
+    expect($user->fresh()->email)->toBe('delete-'.$user->id.'-doppelt@example.com');
+});
+
+it('keeps the pseudonymised email within the column limit', function () {
+    $user = makeDeletableUser(str_repeat('a', 240).'@example.com');
+    UserUtil::deleteUser($user);
+
+    expect(mb_strlen($user->fresh()->email))->toBeLessThanOrEqual(255);
+});