A site needs to know email is valid before allowing it to be used to log in. In OP's world malicious attacker can do whatever between time they register and ti

A site needs to know email is valid before allowing it to be used to log in. In OP's world malicious attacker can do whatever between time they register and time (if ever) email's owner clicks the "wtf, not me" link.