Unconfirmed email in cognito userpool

I would suggest you 2 approaches:

• I would suggest to enforce “Allow Cognito to automatically send messages to verify and confirm - Recommended”**, this will avoid having spoof email users duplicated, as the email will require confirmation for account creation, mitigating duplicates with unverified emails.
• The second option is to have a scheduled Lambda to check and verify emails against unverified and clean up accounts that are not necessary; this is not a best practice as you may run into issues Lambda Timing out after 15 min (depending of the size/users inside of the UserPool), you may want to use this to clean the UserPool, but I would suggest you to look into a different Sign-up flow.