To understand this report, first, let's have a look at the profile fields for setting one's primary email address in the system.
On most sites in the network, you'll find that option in Edit profile and settings and Edit email settings:
On Area 51, which uses a relic of the Stack Exchange engine as it appeared in 2011, you'll access the page on the info tab of your user profile, and clicking "edit":
You might think that both fields edit the exact same thing. But they actually edit two different fields. For clarity, I'll call them legacy field and notification field - you'll see why those names make sense later.
Before the notification system was completely reworked, there was just one email field in the system - the legacy field. This field existed on all sites and could be updated on all sites using a settings page similar to the Area 51 screenshot above, and was used for all system notifications as well as for Gravatar.
When the email notification system was completely reworked, a new email field, the notification field, was created, and is the field that is updated by the modern site screenshot above. This email address is the one used today for notifications. However, on all sites, the information that was previously retained in the legacy field was retained - it's no longer visible in the profile info to a normal user, and is visible only to moderators, but it's still there.
This, therefore, can mean that users who've registered accounts prior to the notification rework and have later changed their email address still have their prior email address stored - it isn't in any way shown to the user, neither is it editable. It also has the added side effect of not changing a user's Gravatar if they're using that (the Gravatar system still uses the legacy field).
Per the link above, this also affects users who originally joined using an unregistered cookie-based account and later registered their account - the email address used at the time of cookie creation is retained even if they register and change it in their profile.
Why are these two profile fields retained as separate fields, rather than being unified into a single field? It doesn't make much sense to me to retain them that way. If the concern is about Gravatar, then why not update the Gravatar system to use the notification field?
Also, can we please unify them into the same field on all sites? If that's not possible, can we clear out the contents of the legacy field for all users on all sites? I understand Area 51 can't be updated to use the new system, but it still has only one field, and it's directly editable.
Update after answer
It now makes sense to me why there are separate fields, and that the new notification field is verified and saved network-wide while the previous field is not verified and stored per-site.
However, the answer states this:
We can't just clear the field for all users. That would break a bunch of stuff for users who aren't concerned about it right now. [...] We can clear those obsolete Email fields on a per-user basis if a user is concerned about an old email address being attached to their account. All they need to do is ask.
Can we please make it clear to users changing their email address that if they want their prior email address to be removed, they'll have to make a request? This is not at all clear to someone who doesn't know the innards of the system (the person I linked earlier didn't know this until they curiously looked at their own profile with a moderator-only tool), and it would be very nice if this were made clear.