Can whoever keeps doing the email verification code thing test that against a greylisting mail server and not set things to time out before such a recipient receives your code? (Also maybe make sure that retries get sent from the same outgoing mail server so that people don't have to wait for the 4th code before getting one that can possibly work.)