Todo: fix security risk here. Guessing the activation key becomes possible after the user activates his account if you have knowledge of when the account was last activated.