The way it's supposed to work is if there is an unactivated account, and somebody registers another account with the same name, IP, or email address, it will overwrite the original unactivated account. This is so somebody who mistypes or puts in an otherwise invalid email address will have a chance to re-register without creating multiple accounts. There is a bug, though, where a situation like you described is possible (happened with DragonForce, I believe). I haven't had a chance to investigate it yet, but it's on my list.