I'm not sure I would have contacted Apple about this, given their penchant for punishing security researchers who bring problems to their attention.
What I don't fully understand is if the attacker doesn't need access to the email account in question, why would they even use valid email addresses? Wouldn't it be less risky to use bogus addresses?
It's because most registration form not only checks that the email address you entered is valid but also whether it exists. This is done by using nslookup to query for a domain's MX record and then checking the specific address.
What I don't fully understand is if the attacker doesn't need access to the email account in question, why would they even use valid email addresses? Wouldn't it be less risky to use bogus addresses?