[SignalsFromBob]

Instagram is another site with this problem. Someone supplied my email address when creating an account in late 2018. I only know this because I started receiving emails to confirm my email address. Then I started to get a bunch of emails telling me about new posts from other users. Gmail account history only showed logins from my browser and IP address, so I don't believe my account was compromised.

I finally got tired of the emails, so I told the site I forgot the password, changed the password to something long and random, then deleted all the content. I remember having to do something unusual to delete the content, like spoof my useragent to pretend to be a mobile device, or something like that. I've never used Instagram before or since, but it really annoyed me that I have a problem due to their lax controls.

Instagram never should have activated the account and allowed any activity until the email address was verified, which I never did. If a big site like Instagram can't get this right, it doesn't surprise me that a small site like Goodreads can't either.

[harryh]

Instagram never should have activated the account and allowed any activity until the email address was verified

Essentially zero services on the internet operate this way because it increases the friction to signing up & getting started with the service.

Some services do somewhat better by including a "this wasn't me" link in the email verification email to make it as easy as possible to remove your email from the account in question. IMHO, this is a fine way to handle the problem.

[pferde]

Except that users are (or should be) trained NOT to click on any links in spurious e-mails they receive.

No, dear sites, kindly deal with a little bit of sign-up friction and stop offloading to others the fallout from people abusing your services.

[harryh]

It's not just the sites you are asking to deal with that friction, but also every single individual user who ever signs up for anything on the internet.

That's a lot of friction. Too much.

[EvanAnderson]

Just did this last week with an Instagram account tied to a free email I hardly ever use.

Epic Games also doesn't verify the email address, because my email account "had" an account there too. Worse, it had a credit card saved and appeared to be ready to allow me to use the card after I did the "forgot password" and gained access to the account.

I ended-up deleting both accounts.

[organsnyder]

Goodreads is hardly small—it's owned by Amazon now.