88ccd0ecbb
- Silently block verification code for IPs with 2+ registered accounts - Silently block Gmail alias emails (containing + or . in local part) - Add CountByRegistrationIP to UserRepository interface - Pass client IP to SendVerifyCodeAsync for abuse detection Both checks return fake success to prevent enumeration attacks.