We don't use Haraka but we do use Firebase!

Thanks for the feedback!

You only move up the waitlist if a person you refer verifies their email. Robinhood Crypto had this issue where they didn't check email verification and people gamed it. Made sure to handle that nefarious use case. But thanks for asking! I guess you could own a ton of fake emails and still be adversarial. In which case, I should probably implement an IP rate limit like you suggested.