why would an email confirmation be enough? playing whack-a-mole all day with different domains is unreasonable. whitelist only of domains is awful, and botters have tons of popular email accounts.