Isn't this the exact reason we 'verify email address'?
What's the point of that entire handshake then?