> The attack would require the collusion of many parties. Not sure what parties you have in mind here. As far as I'm aware, it would only require the involveme

> The attack would require the collusion of many parties. Not sure what parties you have in mind here. As far as I'm aware, it would only require the involvement of a single party entering a bunch of fake or scraped email addresses into a registration form. The malicious party wouldn't receive any benefit, but the web site operator would have their funds drained. > One could imagine the system requires a one-time registration fee orders of magnitude greater than the spam penalty. Requiring every online service which sends emails to charge users to register would be disastrous. It would make entire classes of web sites (like hobbyist forums, or even free trials of paid services) infeasible to operate.