Signup on a site I run asked people to prove they owned their email address, and then asked them again. First a six-digit code, emailed and typed back in. Only after that does the account get created.
Source: [Dev.to](https://dev.to/henry_dan_81513dd35a2f540/a-second-check-is-a-second-source-of-truth-39lf)