Two-way encryption algorithms similar to bcrypt

I'm in need of an algorithm that can perform a very specific task: take a short string, encrypt it using an algorithm which can be scaled to keep up with Moore's Law/has a proof-of-work factor/is unusually slow, and then, later, decrypt it at the same time cost.

The use case is a list of email addresses being stored for a mailing list by a security-conscious client, to be decrypted one at a time for each email; the goal is to make brute-forcing as time-consuming as possible. I've looked into some of the likely candidates (AES-256, mcrypt, twofish, scrypt), but it's unclear which would be best suited.

For what you hope to do, the choice of block cipher is probably not as important as the mode of operation. What you need is a mode of operation where both encryption and decryption are non-parallelisable and then to iterate a number of times that is troublesome, but not infeasible.

My recommendation is to use Output Feedback (OFB) mode. Generate a unique Initial Value; feed this into the (e.g.) AES block cipher; then feed the output back into the cipher and repeat, say, $2^{35}$ times depending on exactly how much time you want to require of the client. Then XOR future outputs onto the e-mail address. The encryption/decryption time will decrease with Moore's law, but there is no benefit in buying more hardware.

Now, after decrypting once, the client could simply save off the last output value prior to XORing, but equally they could save off the address once decrypted.

Another option would be to use Propagating Cipher-Block Chaining (PCBC) mode, but this would involve the generation of as many unguessable inputs as the number of iterations which feels unnecessary.