[nailer]

> I've never seen anyone else acknowledge "confirmation of email address existence" as a security issue

Every guide to setting up an email server starts with "turn SMTP verify off if your server has insecure defaults"