Is there a potential race here, if I re-create an account at the same moment as the legitimate owner is verifying it?  Along the (highly-unlikely) lines of:

  * legitimate owner clicks verification link, we load their email record and confirm that the verification code is valid
  *  **PAUSE**
  * I submit a request to create the account, it loads their email record, checks that its not verified yet, and replaces their record with my own
  * **UNPAUSE**
  * the verification request continues and marks the now-malicious email record as being verified

Perhaps there some way to avoid this without complicating things too much.  For example, the db.verifyEmail() method could take the actual submitted code, and do "UPDATE accounts SET verified=True WHERE uid=BLAH and CODE=BLAH" and then report success or failure based on how many rows were updated.