Comment by pagecalm

Honestly just don't send anything past the verification email until the address is confirmed. A lot of the other fixes here are working around what's really just auth libraries trusting the address on signup. Feels like that's the thing worth fixing first.