Hi there,
The logic behind the process is this:
First the user fills in the registration form & submits it
Then your site must process the submission & create a temporary/inactive user profile for the registrant, at the same time, your site must send a mail to the new registrant containing a link to an account confirmation page which then processes the user and finalizes/activates their account.
I find a good way to secure this (albeit lightly) is when you create a temp profile, have a column in your user table which is 0 for active and a unique identifier like 'md5(time()."".$user_email)' for any inactive users, then in the confirmation email, append that identifier to the link so that when the user follows it, the confirmation page can be certain of which user is trying to confirm their account.
Hope this helped,