Derive the queue, do not store it: resumable email campaigns
A bulk email run that crashes halfway is either restarted from the beginning, mailing everyone twice, or tracked with a cursor that goes stale. There is a third option: compute who still needs the message instead of recording it.