I am sure all popular services have users who try using emails of others (ex: celebrities) to register. This can be done as a joke or as a coordinated attack.

Obviously, those who get unexpected notifications add them to their spam directories. This affects domain reputation and the brand.

What are the best practices? Rate limits? CAPTCHAs? Anything else?