A site could mitigate this by responding with a form to be posted, asking the user to click a button to verify. Only the POST request after user interaction wou

A site could mitigate this by responding with a form to be posted, asking the user to click a button to verify. Only the POST request after user interaction would verify the email address.