title: How to deal with an attack on registration-form?
body: <p>Question on registration process</p>
  
  <p>I was thinking about email verification, and was playing with some app. 
  What if </p>
  
  <p>-) an attacker write a script that register millions account with different random email address(all existing, people's email)Then when the people register, it will prompt email already exists in db? </p>
  
  <p>-) Or even simpler, what if a user register with someone else's email address? The registration Ajax triggers a creation of userid and info into the user table in the DB, but the verification is not done. </p>
  
  <p>But then, when the "real" user with the email register, the email is already taken...?As there can not be 2 email address exist in the db at the same time(As the script won't be able to distinguish between the users....</p>