So for all intents and purposes, anyone could register an account and then use someone else's email address and claim it's their own, and then take their balances?
In theory, yes. If someone was able to take control of the email address they wanted to use so they they could verify the registration.
In practise, no. Your question assumes that "solvent" coins will be made available for withdrawal. This appears to be highly unlikely.
Apparently you haven't been paying much attention. We have been repaying solvent coins lately. Even POT has been repaid, and everyone thought it was gone! I'm surprised there haven't been more people to notice this fact.
I imagine more people haven't noticed because the people paying attention had traded out POT at a loss when they were told it was all gone. I bet those people are jumping for joy at those coins not being lost after all. I never touched POT so I I'm not one of those people anyway. I have, however, been paying attention to the total number of "solvent" coins made available for withdrawal in the last eight months, or however long it's been since you withdrew your own coins and suddenly closed down that option for others. It would be nice if the pace was picked up a bit.
My one consolation is that the coins I do have in my "Balance Reported" column are likely to increase in value, so I'm unlikely to sell them just yet even if I do get them "into my wallet where they belong" (paraphrasing from the text on your front page). It would just be nice to have that option sometime this decade.
Yes, I'm aware that your exchange doesn't query the database to spot changes to coin trade balances until each user logs out and back in, so I've been doing that every couple of days or so. No luck so far, and I'm not holding my breath.
