It's a good reminder that you can't just build the registration and on-boarding processes to filter out spammers.

You have to ensure that the damage is limited and reversible even if your trusted users (or worse, staff) are hacked or turn malicious. Though this system is usually harder to build and generalize.