email bombing

The verification email is a reflection primitive

Email verification flows that send mail on request become reflection primitives. Why subscription bombing passes SPF, DKIM and DMARC, and how to detect it.