[charles_f]

* recover password

* prevent signing up for someone else (validate it is you who owns the email)

* poor man's mfa, although please allow me to use totp instead (probably the three most legitimate reasons from a user perspective, email validation prevent you from making a typo)

* send ads and notifications (legitimate from the provider's perspective, they want campaigns to succeed, email validation makes them sure emails land)

* reduce throw-away or bot accounts