This suggestion makes things worse. If you make a service and ask for email validation, you want validation that the user has that email address. Since anyone

This suggestion makes things worse. If you make a service and ask for email validation, you want validation that the user has that email address. Since anyone can spoof e-mails from any address, getting an email from the address is not validation for anything. You need to send an email to the account and get a response to validate the email address is real. Otherwise it's trivial for me to go to any web site and pose as you. All I would need to do is spoof your email address. Edit: I agree that the current state of affairs is unsatisfactory :-)