Yeah this seems like a bug in the feature – @eviltrout worked on it, can you confirm this does not work Robin because I don’t think it should.
Once the user has confirmed their email, that function should no longer work.
This is basically a security exploit so I think handling it should be prioritized.