There’s a pretty trivial way to fix this, if you’re willing to block post-signup access until the email is verified: 1. Make the signup look like it was succes

There’s a pretty trivial way to fix this, if you’re willing to block post-signup access until the email is verified: 1. Make the signup look like it was successful. 2. Tell the user to check their email. 3. If the account already exists, send an optional password reset email to the account owner (tailored to explain what happened if you prefer, throttled to prevent spam/abuse as you see fit). 4. If you want to go the extra mile, check for password reuse and make the password reset mandatory, or at least strongly encourage it in the email.