I was actually thinking they would have to do this. Having to mail a physical token to a valid address is a extremely powerful access control method.