email addresses are strings, if the website where the registration is being made makes no effort to validate the email address is controlled by the user session registering it, how do you suppose to block it from happening?