creating a user with a null password but with state "email verification required" would mean a semi-anonymous person
could enter content, and if they ever wanted to edit it
they would could turn it into a real account simply by validating their email.
I am not sure what you would do about the second message they entered if they had not verified their email address
(I guess as long as the account had a null password and
had not verified you would let them continue entering data
using just their email address).
Anyway, I lean towards #2 as the better solution and really
easier in the long run as well.
