We have definitely seen people get in trouble when they enable SSO but do not validate emails or have a captcha on signup.