Compared to the current status of doing nothing, where the malicious recipient has their email associated to the account of some other person without even having to click a link?