The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email.
If they have not verified their email they simply cannot log in. I noticed some major website for instance allow you to register and login without email verification.
For instance, Twitter allows you to register, once you register it logs you in. There is a message displayed you must verify your email to use the site, but the site is still usable without it.
Facebook also has a similar procedure where you can login without verifying. Most of the features are available too, such as being able to write to the servers (posts tweets and statuses), and read information.
My question is what could be the thought process here? If you allow for people to login without verifying, what is the point of email verification? How does email verification then provide much extra security?