That's what I do except that I don't disable the account (except in the case of blatant spam) but just forbid the user to upload more than one photo until his email has been confirmed...