First, CSRF protection is not a part of the problem or solution here, you're just overloading the term to be synonymous with session. As I pointed out in my comment, CSRF protection is primarily to protect against an attacker performing an action on behalf of an authenticated victim. Account creation (in most cases) is an action performed by an unauthenticated user. You don't typically let an authenticated user create an account at all, CSRF or no CSRF. (Membership management interfaces are out of scope for this discussion.)
The bottom line question I see here, is "Does it matter if a single browser session creates multiple accounts, if email verification is a part of the user creation process?"
The answer is, it depends, but probably not. What's important is, what threats are you trying to protect against?
Automated spam user creation? In that case, it probably doesn't matter. It's easy enough for a bot to throw away session cookies and they typically don't follow through with an email verification process.
If you're trying to protected against unsophisticated human spammers, it might offer a bit of additional protection. Not much, but a little. However, I'd say that this is true for your scenario 1 as well. Even without email verification, there's not really much to be gained here, in terms of security. You'll get, by far, the most additional protection from email validation (and other additional measures, like a captcha, or throttling the number of accounts that can be created by a single IP address) and very little from attempting to limit the number of users created by a browser session.