It used to be every site would require a verification email be clicked through. Later on some didn’t. I thought they must have some extra and impressive security to pull this off. Turns out they likely all have nothing in place to make up the gap.