I wonder if this is a potential denial-of-service bug?

There are two scenarios:

1. The expected use-case: Create account(s), assign number for verification, verify, account active, number remains assigned to account(s)

2. The unexpected: Attempt to create account(s), assign number for verification, ignore or fail verification, no account created

If the attempted use of the number in (2) is counted and remembered then there's an anonymous potential DOS against any number