Is there any risk to an Activation Email?
My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL Membership Tables.
There is a third party application that holds an Email, a not so secret 4 digit ID Number for each potential user, so the user must use this Email and ID together in order to register an account, the account is not "approved" until they activate their account using the link in the Email sent to this Email. only employees can set the Email and ID in the third party application.
This site handles signing up for an Email Subscription of semi-privileged information, this site doesn't actually handle the emailing of the semi-privileged information.
Other than Social Engineering, what is the risk associated with this set up for user registration?