I've scanned through the Communication Express Customization Guide, which didn't provide any clues.
After much tracing of codes, I finally found the place to change in /var/opt/SUNWuwc/absjs/search.js:
function setFilter(searchString, type) {
if ((searchString == null) || (searchString.length <= 0)) return;
//var filter = "entry/displayname=";
var filter = "email="; // - to search by email instead.
....
The mapping of the Javascript filter names to actual LDAP attribute names is specified in /var/opt/SUNWuwc/WEB-INF/config/corp-dir/xlate-inetorgperson.xml and xlate-groupofuniquenames.xml.