I'm currently working on the email confirmation for the next version, which should be available as an option.
For sites which switch this on, and which are upgrading from a previous version of Q2A, does it make sense to automatically "grandfather" old users so that their email is considered confirmed? I think the answer is probably yes, since most old users will be legitimate, but thought I'd ask the floor.