> it depends, a lot of times they just trust that the token is one time use to set up an account that gets added to the group and doesn't check anything Hmm.. without checking anything would be a security issue, unless the signed up email is verified separately during sign up