In a new ASP.NET MVC application I'm working on we'd like an administrator user to be able to set up other user accounts by creating invitations which will be emailed to the new user. That email will have a link that will take the user to a one-time page where they can either create a site login or elect to login with an OAuth provider (LinkedIn in our case).
I'm concerned with the potential security implications of such a process. The danger is that a user's email could be compromised and an account established by an attacker, thereby gaining access to the application.
These invitations may not be immediately acted upon, so an expiration window would have to be too long to be helpful. Because one user will be creating invitations for another, I also can't restrict based on the IP address.
Am I being paranoid here? Is there a more secure process to handle user creation by invitation?
(Cross-post of my Stackoverflow question.)