It takes both. If people couldn't send a message to your email just by knowing it, then you wouldn't get SPAM. Instead, you could be giving out capabilities, t

It takes both. If people couldn't send a message to your email just by knowing it, then you wouldn't get SPAM. Instead, you could be giving out capabilities, to send you email. And if one of them was abused, you'd simply turn it off, and only accounts who used it in the past could continue to send. New ones wouldn't be.