Sure, that sounds plausible. Not.

I don’t think most people are ware of how insecure the internet is.

Judging by the article they seem to be unaware that IP addresses can be spoofed. Or that an IP address, even when legit, shows the location of the server through which the person is connecting to the internet via their ISP. Sometimes my IP address is located fairly close to where I live in NJ, other times it can be as far away as south central PA.

As for the contention that the sign-up email can’t be faked, that requires a certainty that access to the email account in question hasn’t been compromised. More than one person could be using the account without the legitimate owner ever being aware of it.

In addition, if an unencrypted (or poorly encrypted) wireless connection is being used to access the account, the contents of the packets flying back & forth could be sniffed. The vast majority of email is sent in plain text, so anyone intercepting the packets over an unencrypted connection could easily view the entire contents of every email, including the verification link.