Allowing login without verification?

Hi there -

I noticed that I had what looked like some bots creating accounts on my site but never verifying their email.

I didn't think anything of it because I assumed that User Verification was keeping them out.

I noticed another one signed up yesterday but this time they appeared to have hit several pages on my site. I thought that was strange, so I create a test account to see if I could look at my site without verifying my email. I was SHOCKED that immediately after registering -- and without email verification -- I was able to log in and see all the content.

I looked at the configuration of your plugin and found "Automatically login after verification" but nothing about denying login UNTIL the email was verified. Am I missing something or is this a big oversight?

Thank you