What if someone tries to register with an email that's not theirs. When they register, they get emailed a verification code to complete registration. If that's not their email, they don't get it, so they don't confirm.
How long should I keep this account in the db? I'm thinking 2 hours then delete the account. First is 2 hours enough? Second, is there any reason I should not delete the record with all its info (username,password, etc)?