Courtesy of http://pkp.sfu.ca/support/forum/viewtopic.php?f=9&t=6511&p=25052#p25052, and similar to how password reset currently works: require users click a special link, sent to them via email, to complete registration. This mandates that the email address is theirs. The concern is that otherwise, people could register as someone else; I think this might work as a reasonable spam registration deterrent as well (current forum spam problems notwithstanding).