I do not want to discuss the pros and cons of email validation, but want to know if there are potential downsides (security and otherwise) to user entering his password only after he has already validated his email address (clicked the activation link)?
As you have already asked about the security concerns at security.stackexchange.com, I can give my opinion about the UX perspective:
Do you know any service where you register and it requires only a valid e-mail prior to filling your username/password/other data? I've never seen something like this. If you don't run a popular website, a few people (including me) will think:
Why just my e-mail address? This site don't want me to create an user account? Maybe they just want to know my e-mail address to spam me? Is this site real or a scam?
However, if your site is trustworthy, it can be a nice way to highlight that you really want the e-mail validation before allowing access to your website. If the user doesn't want to give his e-mail, they'll leave sooner and less frustrated since they did not waste their time filling 4 or 5 input fields.
Note: Requiring the e-mail to be valid before allowing access is not user friendly. Some people hate to give the correct e-mail to avoid spam messages when they want to just take a look to your site. Consider this constraint only if you really need the e-mail account to reduce anonymity or if you sell things on your website.
Reducing the number of fields on a form typically increases conversions, however you can go too far sometimes. A user will have an expected number of fields for task, if you are asking for just an e-mail address when an user expects name, email and password. They might not be sure it's the correct form or as Zanon mentions might think it is a scam.
Also as I mentioned in my comments, we (Allies Computing) used to require users validate their email address before being able to trial our API. We tried removing this and the trial usage of the API increased, as we had separately noted that people that tried the API converted higher than those that didn't. We then found this lead to an overall increase in conversion.
We still require that the e-mail address is validated before a purchase and have a small nag message until they validate their e-mail. However by this point the user is normally ok with this, as we need a contact point should anything go wrong with their account.
So unless you absolutely need a validated email address before a user can access anything, avoid it. Perhaps allow them limited access until they validate, I think twitter only requires a valid email to post a tweet, not setup your profile (been a while since I last went through their onboarding process).