> I didn't add any restrictions on email registration […] Exposing web services to the public internet without auth seems scary

Aren’t you still effectively doing that, though?

This seems like the combination of two downsides: Bots will be able to perform email verification if they want to; honest users will still be deterred.