Question

On a standard web signup form, users are required to have a unique email for the site.

if the email is already in use, a new user cannot be created with that email – but this opens op for exploiting this to find out, what emails are members of the site (at least check if a specific email is in use).

Making sure a bot cannot mass-query is fairly straightforward – but is there a way to avoid it entirely?

The best thing I can come up with is letting the user create process fail with an unknown error and shooting an email to the address in the background, explaining password reset procedures.

Am I missing a better option?

Update:

I want to avoid taking the new user out of the registration process for the 99.9% of the time, when the email is actually unique. So halting the registration process to wait for the user to click a link in an email is not a perfect solution, although maybe viable in some use cases.

Answer 1

Let the registration continue as normal, but in the confirmation email you should say:

"You allready have an accout bla, click here to cancel this registration, or continue with new registration and delete your current account"

That way, the spammers never know the better, and its very user friendly.