Thread:Project:Support desk/Confirm by email to create an account/reply

Well in order to email confirm an account, we need to keep a record that the account exists. You cannot confirm an account that does not exist. Having "spam" accounts that can't do anything doesn't hurt anyone.

I would suggest using a captcha to prevent account creation if you're overly concerned.

You can also disable account creation by logged out users entirely, and require people request an account directly from you (say by email), and have it so that only logged in users can create new accounts. Manual:Restricting_access (That is somewhat of an extreme option though). On a similar note there is the Extension:ConfirmAccount extension.