[Shaddy]

The user can log in without an email confirmation!

if I set up an acc and immediately afterwards I log in this is indeed a validating user but he can read and mailbox users under mailbox