That is, you want to allow people to stroll in and start using your app.
Great.
But just don't send out any emails on their behalf unless/until they've clicked the verification link in the one email you will send to them.
This makes me think - should there be a link in the email that says, "This was not me" -- that allows the website dev to ban the offending IP?
Maybe not ban the IP but definitely remove the email from the account (after a confirmation CTA). Some services do this and if I known them I hit the link.
I get a ton of emails for others on a weekly basis with a ton of info not meant for me to see.
One specific account "I" signed up for was a playstation account that actually prevented me from signing up for my own account. It took ~1hr of live chat with Sony to actually create an account with my email address.
(And yes I am aware I can add additional periods or +keyword to the email)