1. Codes should be like passwords. If they're guessable, they're no good. 2. All operations, including signing in, verifying the account, etc should be rate shaped. The more you try, the longer you have to wait till you can try again.