Signing up other people for accounts to mess with their inbox is a well-known abuse vector. The issue here is volume, not intent. Other than doing IP reputation, email domain reputation, and rate monitoring, you can't stop all malicious signups, but you -can- spot repetitive behaviour.
