At a high level, you have to validate what you need. If you don't need the user's email address, don't validate it. If you need an address the user can send fro

At a high level, you have to validate what you need. If you don't need the user's email address, don't validate it. If you need an address the user can send from, validate that they can send from it. If you need an address they can receive at, validate that they can receive on it. Beyond security problems, there can be all kinds of other failure modes. Maybe my domain is blocking email from you. Maybe the address I want to use can't send. If you need the address because you'll be sending password resets and invoices to it, you want to validate that they can receive there. It was never about whether they "own an email account", whatever that means.