[Paul]

Originally posted by GamerForums
I don't understand the need for this. If Jack received an e-mail asking to confirm membership from a site he's never heard of he isn't likely to click the link is he?

While it's rare that someone would accidentally register with someone else's e-mail address, the possibility exists for users to either 1. create accounts intentionally to spam someone (i.e. you have a vBulletin site that is a pedophilia support group and think it'd be a hoot to sign up your co-worker), or 2. create accounts with invalid e-mails (that turn out to be valid) in order to get around the need for providing an e-mail address.

After applying the suggested fix from the vbulletin.com forum, clicking on this link would prevent "reset password" or "activation codes" e-mail floods. I think there's a better discussion for the need of this hack over on the vb.com forums.

On our site, our policy is to let accounts requiring e-mail validation to post without restriction. With this hack, by following the cancelation link in the signup e-mail, the recipient would cause the user to receive a message stating that his or her e-mail address was incorrect and force him/her to change the e-mail address. If you only allow registered, activated users to post, then obviously, this hack is not for you. Since vBulletin gives the option to allow unconfirmed accounts to post, we thought this would be a good hack to release.

We obviously have a problem with invalid e-mails Currently close to one-third of our users have not activated their accounts. We're trying to close up any holes that would allow a method of spamming and to detect any abuse of the system.

An interesting modification to this hack might be some sort of interface in the Admin CP showing accounts which have been marked with invalid e-mail addresses. Doing so would be relatively easy. Perhaps I'll add that functionality tonight if I get a chance.

Paul