Validate Drupal accounts after becoming a member?
Is your validation/invalidation a user role in Drupal?

In that case you can use the Drupal rules module to trigger a role change that checks for 'unvalidated user' when the 'member' role is added, and removes it if found (or the other way around depending on which way your validation works). If your validation triggers on anything that rules can be connected up with this should work, even if it's not a role.

One weird fringe case of data security I would consider with the process you described is if you handle any semi-sensitive to sensitive data and if validated users can access/change about themselves that may already be in your database. In that case anyone could get a validated account that hooks up to the contact data and access it by using an email that is not theirs, even if they don't have access to the email account, simply by paying for a membership.