Hmm 
@nickjbaxter Can you confirm the email as the second step after you reset their password? You know that their email is confirmed since they received the password reset. Would that work?
In theory yes, but how can I ensure “email confirmed = yes” from the back end?
From my understanding, Bubble has this somewhat hidden email confirmation functionality, and (from what I can tell) the only way to validate a users email with this is to use the action “send confirmation email”. However this can only be triggered by the current user, you can’t send a confirmation email on behalf of someone else.
The only work around I see for this is ditching Bubbles out of the box email confirmation, and creating my own one.
You might be right. If the email confirmation is a built in feature, creating your own seems like the easiest thing to do. 
One way is also by confirming the email before even creating an account. Just another idea.
Check out my guide on creating your own email validation:
Hey all - we recently released a feature that will allow you to customize your email confirmation flow more easily. Learn more here: Retrieve email confirmation token without sending email