Here's a couple of quotes from the GDPR (emphasis added).
The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features.
Article 25 (Data protection by design and by default), paragraph 1:
Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.
What does this mean? That if you don't have a good reason to include email addresses in logs, then you probably shouldn't do it. You might log the user ID instead, which has a higher level of pseudonymization, and would still allow you to identify the user if you needed to. IDs are probably the right thing to use anyway to uniquely identify a user, regardless of the GDPR, because I suppose you can expect a user to always have the same ID, while the email address can usually be changed.
That said, even though I'm not a lawyer, I don't think you can get in much trouble for logging email addresses, as long as you are able to demonstrate that everything is stored and processed securely enough. On the other hand, good design choices will definitely help you to demonstrate that you have followed the best practices for security and privacy, and that you haven't put your users' data at risk by unnecessarily processing their personal data.