It looks like a user/users can register multiple accounts using the same email address.
Basically when user registration is restricted (to be verified by admin) and a user registers, the account is inactive. While inactive, the same email address can be used multiple times and multiple accounts can be created using the same email address. Should this happen?