A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1