Confirmation won't help here. In your hypothetical example, I set up a mail server at bulkdownloadrobot.biz and get my bot to use 00001@, 00002@ etc. The bot fo

Confirmation won't help here. In your hypothetical example, I set up a mail server at bulkdownloadrobot.biz and get my bot to use 00001@, 00002@ etc. The bot follows the confirmation links before downloading 60MB for each account. Now, you might detect that bulkdownloadrobot.biz is a bad domain and blacklist it, but all I have to do is to register a new domain each time that happens. So now you implement a heuristic that detects patterns of signups from domains. Now, I start buying Gmail accounts created by workers in a CAPTCHA-solving sweatshop. You've increased my costs slightly, but you haven't solved the problem.