title: In ASP.NET Core Identity, how should I require unique emails only if some user has confirmed the email?
body: <p>Out of the box, via identity scaffolding, <code>UserOptions.RequireUniqueEmail = true</code> allows an actor to hold any email &quot;hostage&quot;, preventing anyone else from ever registering with that email (including the rightful owner). I'm sure there's a workaround, but since this seems to me a significant security hole I'm curious whether a) I'm misunderstanding registration logic or b) there's a common fix apart from setting <code>UserOptions.RequireUniqueEmail = false</code>.</p>