

I’m not defending anyone.
I didn’t expect I had to spell it out for you, but here’s what I’m saying: Until some kind of international investigation force comes out with clear evidence, anyone who tells you “who did it”, is just projecting who they want to be the perpetrator.
Nope, but it will stop the less determined ones.
With no email verification, you can pretty much create dozens of fake accounts per second - as fast as the API can handle.