Should users be allowed to sign up using an email that has already been used…but it’s not yet confirmed?

I have a simple website registration form that only asks for your email, the username you want, and the password you want. To make sure the email is real, we send a confirmation email to the entered email address, where users click a link to activate their account.

But what if the email address is not the real email of the user who's signing up?

Should other users be allowed to sign up with an email that had already been registered...but is not yet confirmed?

• Yes

  A person registers for the website using their real email address, but doesn't check their email until later. Then, some guy registers using that same email. When the first person checks their email, they'll click on the first confirmation message that they see, and they'll unknowingly activate some other guy's account.

• No

  Some guy registers using an email that isn't theirs. Then, the person who really owns the email address attempts to register for the website, but fails because the other guy has already used the email address (but it's not yet confirmed).