Verification proves the mailbox is real.

The link goes to the address on the account, works once, and expires in twenty-four hours. Until it is clicked, password resets stay closed — a reset that can reach nobody is worse than no reset at all.

• Only a hash of the link is stored — a copy of the database cannot be used to verify an address.