Near-duplicate accounts allowed with ignored email mutations

Summary

A security researcher discovered that near-duplicate accounts like [email protected], [email protected], and [email protected] were all treated as separate accounts, while some email services, like gmail and google apps, treat these as the same account. This issue could lead to excess email confirmation messages from Legal Robot to a single real email account. If the legitimate user confirmed the email address (as we are all sort of trained to do with email), the attacker's account on Legal Robot would be activated.