This does seem like a reasonable approach, but would definitely need a rate-limiting system/opt-out to avoid intentional activate-mail DoS to the actual address

This does seem like a reasonable approach, but would definitely need a rate-limiting system/opt-out to avoid intentional activate-mail DoS to the actual address owner. Might also help whoever has foo@bar.com and similar, too.