Nope that's not the case. This bug is due to lack of email verification and Oauth misconfiguration. An account can be created by just knowing their email id.