Someones e-mail being public does not give you the right to send them spam (=which I consider this, under the common definition of "unsolicited mass-e-mail"), and having starred a GitHub repo does not imply consent to that. If someone wants notifications, there are tools for this: they subscribe to your repo, individual issues within it or a newsletter.