There are ways of handling this well. I'll address two common situations: If the site uses the email address as the primary identifier and there is no separat

There are ways of handling this well. I'll address two common situations: If the site uses the email address as the primary identifier and there is no separate username, it is OK if someone confirms a mistyped email address. In such situations, an account should not be created until the email address is confirmed. Let's say matt@gmail.com is sitting in front of the computer and creates an account for mattt@gmail.com. mattt@gmail.com confirms the email address and is now the owner & controller of that user account. matt@gmail.com does not have access to that account, nor did he get a confirmation email. Ideally, he will realize something is wrong and will try creating the account again. If the site uses a username, and the email is just a contact method, the process of confirming the email address should ask the user to re-enter the password.