[avail]

>(email is used when verification is necessary)

This sounds really insecure, many people know my email as I have it shared everywhere (as contact form, etc.), and using just email would mean anyone would be access my catchy account.

[brent_noorda]

The link isn't actually created until you respond to an email saying "did you really create this link?" So it is as secure as your email is secure.