[SAC] spammers honour email confirmation too :(

Just for the record, I'd lifted the mantra requirement yesterday
and a new spammer registered, passing also the email confirmation:

Jul 18 12:02:00 www ldap_create_user.py: account creation request from, confirmation token sent to "calvenreid1@outlook.com"
Jul 18 12:02:12 www ldap_create_user.py: user "pchelp" registered from "pc helpdesk support" <calvenreid1@outlook.com>

I'm re-adding the mantra requirement.