You are assuming that the said site has an email confirmation workflow as part of the registration process (Granted most do these days, but it wasn't the case m

You are assuming that the said site has an email confirmation workflow as part of the registration process (Granted most do these days, but it wasn't the case many years earlier). Even so, you are also assuming that the said site would block your usage unless you confirm your email. Assuming one John Smith creates an account as john.smith@gmail.com ; and then another John Smith happens to create an account as johnsmith@gmail.com - and doesn't confirm the email right away (either the site doesn't ask for it; or doesn't really block any functionality - just keeps showing an annoying warning message). First John Smith can now easily take over the second account by triggering a forgot password workflow - for shit and giggles.