Currently an email profile could be created say jack at ....... by anyone and then the consequences follow.
JIC, the following would be possible (as a check against misuse of the feature):
(1). When being Created while configuring remote account, the Email Profile should only be available if the authentication to the POP account succeeds else the Profile Creation should also FAIL.
(2). For A Non POP Account, there should be some "Validation" email which must be sent to the mail account for which the Email Profile is created and only upon validating by logging into that account, should the Profile be available for Use.
Combining (1) And (2), The Least Common Denominator would be that in the event of Profile Creation, there should be a Validation Email sent to that Email Account (for which the profile is created) and only after Validation should the Profile be available for use.
I know that X-Gmail-Account is there in Header but that really would be only put to use after the nuisance has started. So if possible, why not put a brake before it could start.