That’s potentially a viable attack route: register a billion dead accounts to fill up the database. Reaping them if they never complete an activation step like confirming a ToS or email verification would help protect the server.