Also, I'd suggest required phone/email as the end user seems to be a risk. For example my Twitter account is locked because I never gave a phone. Then a year later it comes out attackers can figure out your number. Not worth it to me.

Also, I can get an SMS over VIOP for cheap for a limited number of days. If I were an attacker the email/phone verification does nothing to stop me.