I think strong identity is going to be how this sort of thing is eventually settled. Email addresses is fine, but there are plenty of sites which provide a means of getting a throw-away address. Maybe mimicking how banks and governments handle it and requesting N out of M different kinds of identity might help?