You can enable auth.require-email-verification to require users to verify their email addresses before they can take actions within the system. With this option off, we're intentionally permissive to make it easy for users to sign up and interact with the system.

If we let you take actions but didn't send you email until you verified your address, it would be confusing (why am I not getting email?) and we'd need to introduce additional UI to communicate to the user that they need to verify. We'd also still presumably want to send some email, like password reset email. When you verified the address, we'd potentially either send you a bunch of queued mail, or you'd never get this mail. It would also be confusing to other users who, e.g., sent you a message in Conpherence that you never received.