<?php

$pattern     = "/^([\w_]{2})(.+)([\w_]{2}@)/u";
$replacement = "$1********$3";

echo "Demonstração com \"preg_replace\"";
echo PHP_EOL;
for($i = 1; $i <= 20; $i++) {
    $email = str_repeat("a", $i)."@teste.com";
    echo preg_replace($pattern, $replacement, $email);
    echo PHP_EOL;
}

echo PHP_EOL.PHP_EOL;
echo "Demonstração com \"preg_replace_callback\"";
echo PHP_EOL;

function ocultarEmail($matches)
{
    return $matches[1] .
        str_repeat("*", strlen($matches[2])) .
        $matches[3];
}

for($i = 1; $i <= 20; $i++) {
    $email = str_repeat("a", $i)."@teste.com";
    echo preg_replace_callback($pattern, 'ocultarEmail', $email);
    echo PHP_EOL;
}