And it is focussed on social networks, which require an email address, which usually implies a device.

But instead of inserting controls around email addresses (as with paid services) or devices (as with contraband), the requirement is pushed to the application layer. It really makes no sense from a technical POV.