How do you handle duplicate, non-verifiers email? Would you create two non-verified records?
If the first user created the record, but the second one legitimately owns it, then the second user will not be able to use their email address - that doesn't seem right to me
If the first user created the record, but the second one legitimately owns it, then the second user will not be able to use their email address - that doesn't seem right to me