This actually sounds like a good solution.

That is, you want to allow people to stroll in and start using your app.

Great.

But just don't send out any emails on their behalf unless/until they've clicked the verification link in the one email you will send to them.

This makes me think - should there be a link in the email that says, "This was not me" -- that allows the website dev to ban the offending IP?