Comment by Jerrrry

  >kind of wish we could just pass a law that says you have to validate email addresses before attaching them to accounts at all. 

We did, the government can only collect the data it needs to complete it's stated objective. fedramp compliance. This exact exploit has happened at nearly every Fortune500 company.

  > otherwise, competitive pressure will keep pushing people towards not doing it and aiming this gun at their foot in the name of conversions

Market forces, people should be pressured to use more secured services.