if it's a known malicious entity I don't think I'd want to confirm that my email address is 'live' either way ... the majority use case here is that they're no

if it's a known malicious entity I don't think I'd want to confirm that my email address is 'live' either way ... the majority use case here is that they're not malicious, merely spammy with good intentions.