Could you elaborate on the countermeasures taken? The takeaway seems to be: 1. rate limit the "verify you email" requests, and 2. have enough entropy for the activation codes.

Another possibility is also not to log the user in after successful activation (i.e., mark the email as active, but don't give access to the account), but I've never seen anyone behaving like this.

Moreover, sensitive operations, like changing settings or deleting the account, should be password-protected (so that, even if logged in, the attacker couldn't damage too much).

Anything else that I'm missing?