[harryh]

Instagram never should have activated the account and allowed any activity until the email address was verified

Essentially zero services on the internet operate this way because it increases the friction to signing up & getting started with the service.

Some services do somewhat better by including a "this wasn't me" link in the email verification email to make it as easy as possible to remove your email from the account in question. IMHO, this is a fine way to handle the problem.

[pferde]

Except that users are (or should be) trained NOT to click on any links in spurious e-mails they receive.

No, dear sites, kindly deal with a little bit of sign-up friction and stop offloading to others the fallout from people abusing your services.

[harryh]

It's not just the sites you are asking to deal with that friction, but also every single individual user who ever signs up for anything on the internet.

That's a lot of friction. Too much.