Indeed. You should always validate emails for accounts.

The amount of accounts I “have” and can’t cancel because of sites not doing any email-ownership validation is quite annoying.

> in a purely practical sense the mockup at the end of the article showing an explicit warning about email being sent to a non-canonical address is clearly excellent and should be implemented.

Gmail is doing something very nonstandard here and it’s absolutely their responsibility to inform users why they are getting emails on addresses (most?) users would never know about nor use.

I’d even say that having this feature on with infinite whitelisting by default is a security issue which should be resolved.

Preferably by only allowing explicitly whitelisted entries created by (the few) power users using this feature.