This is so funny. I've seen websites that leak one-time code through client code so the verification could be automated, but this is another level. Generating a code client-side and allowing the client to decide what the email content could be!
I have used the LEEP portal. Honestly - people are making a huge deal about this, but the verification code could be completely removed and it wouldn't matter. You can start the same process by just emailing the helpdesk.
It makes me chuckle to think of the contractor’s thought process on how you implement email verification. How could you not even Google something so simple before you reinvented it yourself in the worst way?
It takes time to google things, and the engineer is paid to write code not google stuff.
A department manager at a previous job once blocked stackoverflow. It went about as well as you'd expect and he unlocked it two weeks later.