verify operations through email
You should force user registration before checkout and allow Drupal to handle this. There are a couple of things you can do to make it very tough for non-humans to get through:


Require user verification for registration. This is out of the box functionality with Drupal and is accessible in the system configuration area.
Consider using a module such as Captcha or Honeypot to expose traps for bots so that they cannot continue.


Don't work against Drupal's user and form system on this one. Let them do the work for you.