In Django, as an example of one web framework, the email address would still be in the users table. There'd be a flag somewhere else in the database to indicat

In Django, as an example of one web framework, the email address would still be in the users table. There'd be a flag somewhere else in the database to indicate whether it had been confirmed or not. Only a sign up system that has separate storage for unconfirmed registrants, or that purges unconfirmed accounts after a period of time, would keep your email from showing up in the dump if a buddy signed you up as a prank.