This is voodoo @lgaertner but (having experimented while wondering) seems to work...
Workfront (nee AtTask, nee @task) was originally built upon an Oracle back end, but (likely to reduce licensing costs) moved to Postgres several years ago. Both, though, happen to use the same couple of special characters for wildcards under the hood:
% for an unlimited length wildcard search, and
_ for a single character wildcard search
With these special characters in hand, you can then do some basic pattern matching to find some interesting combinations, such as finding a particular users via their email address, as you're attempting. In my instance, I have MANY "Brian" users, for example, but to find the ONE among them whom I'm looking for (namely, Brian.Tompkins-spm@esuite.ca), I can use the following search string in the Advanced search, which then returns what I'd expect, as shown below.
%brian%tom%@%ca
To make the API work in a similar fashion requires HTML encoding of the % signs (which are "special", and happen to equate to %25 when encoded), but having just now confirmed those facts, I'm pleased to confirm that the following ALSO works, and returns just my ONE expected "Brian" (results below):
https://atappstore.my.workfront.com/attask/api/v15.0/user/search?emailAddr=%25brian%25tom%25.ca%25&e...
And finally, while we're at it, this cilike mod also worked, too (same results):
https://atappstore.my.workfront.com/attask/api/v15.0/user/search?emailAddr=%25brian%25tom%25.ca%25&e...
I invite you to apply these tips to you situation, which I hope encourage you to continue travelling your preferred path.
Regards,
Doug

{
data: [
{
ID: "575f555e00124c43bb5558acc712b4e8",
name: "Brian Tompkins",
objCode: "USER",
emailAddr: "Brian.Tompkins-spm@esuite.ca",
licenseType: null,
myInfo: null,
phoneNumber: null,
title: "VP Exploration",
workHoursPerDay: 8
}
]
}