I've been thinking about this for a bit as part of a system I've been working on. Obviously the only thing you can tie a user to is their email address.

I'm thinking along these lines: when you register, your account is marked 'provisional' until you log in at least once, and maybe do somthing like post, change password from the random one that was given ... if it is still provisional after say one month, delete it. To me it makes sense to do this, all part of trying to keep meaningless data out of the system.

I think that once someone has used the system once, you are pretty much honour bound to keep the account open.

These little glyphs that give non-machine readable digits to be included in the membership app are good too. Seem to remember seeing something on CPAN to do that, might be wrong.