Hari it applies everywhere an email can be typed as long as the Flarum user validator is used behind the scenes.
That means the SignUp form, the email change request and the user edit modal. From web or REST API. Admins can't bypass the rules.
There might be other extensions that use the user validator and benefit from it as well. For example in the other whitelist extension (username), the FoF Username Request extension will also benefit from the username validation since it re-uses the Flarum user validator.
I have not checked how the social logins are impacted. I suspect they don't use the validator so if you have social login enabled they might be able to register other email addresses.
