How to handle creating new account with email address that is unverified on another account?

Question

We have email address verification on our accounts. Users have to verify their email addresses when they create their accounts and when they update their email addresses on existing accounts. With new accounts, users cannot finish logging into the site until their email is confirmed (this will probably change eventually so that they may log in but be unable to do certain things). In the case of existing accounts, the new email is held in a "pending" state and the system continues to use the old email address until the new one is confirmed.

We also have a restriction that there cannot be more than one account with the same email address.

My question is what happens if someone creates a new account or updates an existing account with someone else's email (but can't confirm it) and the person who owns the email address tries to create an account.

Answer 1

The simple answer would be to only hold the new address in a pending queue for a limited time. Something like 2 days should suffice. If someone hasn't activated their account within 2 days, it's a fair bet that they aren't going to.

If you do this, you should mention in the activation email that they have 48 hours to activate their account etc.

Answer 2

When creating an account and confirming an email, don't you send the email address the user gives an email in which they have to click on a link in order to complete the sign up process? If so, add a line saying "if you didn't start this process, click here to remove your email address from our system" which directs the user to a script on your site that does what it says. If not, build this!

So now if someone else creates an account using my email address, I'll immediately see it happening and be able to act on it. The second situation you describe (me trying to sign up while my email address is already being used in a sign up process) won't happen because it's pre-empted by the notification.

Alternatively you can have signups auto-time-out unless the activation link is clicked, in which case users who didn't sign themselves up don't need to do anything (which may possibly be preferential else I could "spam" someone by forcing them to keep clicking links to unsubscribe themselves from a possible signup process).

This is similar to what JohnGB said in his answer, except in reverse - rather than saying you have a window with which to sign up, just give them an out if they want to take it.