The thing that protects you the best is obscurity. If you have hordes of determined bad guys targeting your site it's probably not so bad -- it means your site is very popular (or stores credit card numbers).
Generally, IP addresses are a much more limited resource than email addresses. Although open proxies and botnets make them less so. Reddit probably fights off abuse primarily based on individual IPs and entire address blocks. IP geo-location can help a lot in certain cases too.
CAPTCHAs really do the most to slow down the worst kinds of abuse.
I agree. Obscurity is fine in this case, because if abuse becomes a problem, it will be new accounts that are the problem. So you can just add confirmation, captcha, etc. on the fly when the time comes.
Generally, IP addresses are a much more limited resource than email addresses. Although open proxies and botnets make them less so. Reddit probably fights off abuse primarily based on individual IPs and entire address blocks. IP geo-location can help a lot in certain cases too.
CAPTCHAs really do the most to slow down the worst kinds of abuse.