The Help Desk is flooded with requests relating to account verification and account recovery. Many of these are claims that emails aren't being received. When I ran a test, my email arrived immediately. However, there still could be an issue with certain email servers if all the following are true:

the individual...
(1) typed the email address correctly
(2) checked the spam/junk folder
(3) waited sufficient time for any graylisting filters

So, let's go with the assumption that there is an issue and eliminate causes:

(1) Emails are using SPF records and DKIM signatures, so that should greatly reduced chances of outright rejection.
(2) There are no bounceback messages within the inbox for the automated email address.
(3) No recipient domains are blacklisted from the outgoing email server.

I'm at a loss for other potential issues, so I'd like to consider alternate means of verification. Any suggestions are welcome, whether SMS-based, app-authenticator-based, etc. They just need to be free solutions.

Once this is resolved, I will update the sign-up process with better validation means (whether CAPTCHA or something else) and should be able to remove the page for admins to manually verify accounts for sign-ups who haven't seen emails.

As for account recovery: emails are only one part of the problem. There are individuals trying to regain access to old accounts and no longer have access to the email addresses used during creation. I've purposely kept minimal identifiable information in accounts, so that makes it difficult to offer alternate means to regaining access. There are several methods that can be used going forward, from security questions to access keys. However, does anyone have any ideas to make regaining access to an old account possible without a great possibility that someone else could impersonate the original account holder?