Yes, I just took a lunch break and came to that thought too. As you suggest -- ask them to register, send out the email, authorize them immediately, and then force them to need email verification if they haven't responded within a week. I think we can check by checking the email_verified_date.
And that should work, although intriguingly, uh bugifyingly, when I scan the users table on one of the systems I admin, I can see that there are users in state authorized that have a null email_verified_date. This suggests to me a bug somewhere within the OpenACS 3.2.5 registration system -- this system has always insisted users verify their email address.
