An option to enforce email verification when creating an account should exist. This would ensure emails used belong to the folks using them.
In System Settings > User Profile the primary email address field should have an additional option to enforce email verification, similar to how require confirmation exists now. This would prevent an applicant from starting or submitting their applications until they've confirmed they have access to the email they're claiming.
While at it we should enable the Confirmation option on the primary email in the User Profile. It makes sense that this option is disabled on the submission form for the User Profile primary email field but it seems like an oversite to have it disabled on the User Profile.
I've highlighted the primary email field on this user profile screenshot and mocked up how the Confirmation and Verification options should be presented.
Using SSO this can be alleviated if the accounts are properly verified on the client end but otherwise our workarounds have been to use a letter of recommendation field, either stock or with a tiny bit of custom coding. Bit messy either way.
Makes sense; as the overwhelming majority of our customers use SSO; the ones that don't typically use the software for casual (low risk) usage, we do not enforce this. However this is approved. Please write this up in our internal feature request tracking tool.