The instructions did not give an upper bound in terms of functional requirements, though the lower bound of "realistic use" was given!
So yes, I would assume that includes things like full email validation round-trip too.
Even just slopping together an in-memory, no-email-sent deployed solution is at least 3 or 4 hours in my book, which seems way excessive for a pre-screening question!