This seems way too unsecure. Could a bad actor exploit this with a massive list of emails and random codes? Even when you have like 5 tries from 1000000 combinations, someone's likely to get hacked with this...
Very long time ago someone abused a referral program of a taxi service by registering multiple accounts just by random-guessing the code. They had badly written rate limiters so a list of 10k proxies, good broadband and a java threadpool were enough to get thousands of free rides in a couple of days.
