Another solution which is totally different is to add some sort of rate limiting to the send email verificaiton API on the backend. This way, nothing else would need to change. If the users refreshes the email verificaiton screen many times, they will still not get an email. A good rate limit could be one email per minute, per emailID