Fixed: an account whose email address was not confirmed could see and accept team invitations sent to that address. Anyone can register an account with someone else's address, so an invitation sent to an address is now listed on Your teams, on Dashboard, in Team chat and in the Magpie app only once the account's address is confirmed. Until then, Your teams says Confirm your email address to see invitations sent to it, with Send a new link, and the app's Your teams does the same.
The link in the invitation email still works for the account at that address, and joining or declining with it confirms the address. Invitations by handle are listed as before.