It could be dead simple. Lock the account, but let the owner temporarily unlock it for X days so they have enough time to undergo verification.