Yup. More importantly, they should verify email addresses at registration time and delete accounts which don't get verified.

Almost all other sites do this. It's simple best practice and it stops them spamming third parties.