So I guess I'm not wrapping my head around your suggestion here:In retrospect I'm not so sure that made sense.
It certainly wouldn't for a +subscribe, as the Pending Subscription notice isn't sent until after the confirmation has been acted upon. I was thinking about the web Request flow, but even there I'm not certain exactly when it is sent.
Anybody can easily go to the site and apply with various people'sSo far at least one uses the site manually, one application at a time. Whereas crooks have long had the automation to send emails by the millions, each with an address to and spoofed from their long lists of collected victim addresses.
That catastrophe happened about a decade ago on Yahoo Groups. Some crooks put together the web automation to create new accounts and new groups by the millions, abusing Yahoo Groups servers to blast out spam.