diff --git a/docs/changelog/7.x.x.txt b/docs/changelog/7.x.x.txt
index ebeae6412..f4db3eb30 100644
--- a/docs/changelog/7.x.x.txt
+++ b/docs/changelog/7.x.x.txt
@@ -40,6 +40,9 @@
  - WebGUI::TabForm->addTab now returns the WebGUI::HTMLForm created.
  - WebGUI::AssetLineage::getLineage can now limit the number of records returned
  - fix: IP addresses for adminModeSubnets not using X-Forwarded-For properly
+ - add: workflow activity for expiry of email-unvalidated users.  This is not
+   enabled by default; add an instance of it to an appropriate workflow if you
+   want it to run.
  - The Events Calendar is now the new Calendar with some fun new features.
    All your existing Events Calendars will be migrated automatically. 
  - Major change: password recovery is now based on profile fields rather than
diff --git a/docs/upgrades/upgrade_7.2.3-7.3.0.pl b/docs/upgrades/upgrade_7.2.3-7.3.0.pl
index 3fef66349..256aba9cf 100644
--- a/docs/upgrades/upgrade_7.2.3-7.3.0.pl
+++ b/docs/upgrades/upgrade_7.2.3-7.3.0.pl
@@ -24,6 +24,7 @@ deleteOldFiles($session);
 addFileFieldsToDataForm($session);
 makeRSSFromParentAlwaysHidden($session);
 addProfileFieldsOnPasswordRecovery($session);
+addEmailValidationExpiry($session);
 addNewCalendar($session);
 migrateCalendars($session);
 removeOldCalendar($session);
@@ -294,6 +295,26 @@ EOT
 	$session->setting->set('webguiPasswordRecoveryTemplate', 'PBtmpl0000000000000014');
 }
 
+#-------------------------------------------------
+sub addEmailValidationExpiry {
+	my $session = shift;
+	print "\tAdding email validation expiry.\n" unless $quiet;
+
+	# Remove email activation keys for active users so that if they deactivate themselves
+	# in the future the workflow activity doesn't treat them as deleted.
+	$session->db->write($_) for (<<'EOT',
+  DELETE FROM authentication
+        WHERE fieldName = 'emailValidationKey' AND
+              (SELECT status FROM users AS u WHERE u.userId = userId) = 'Active'
+EOT
+				    );
+
+	my $activities = $session->config->get('workflowActivities');
+	my $class = 'WebGUI::Workflow::Activity::ExpireUnvalidatedEmailUsers';
+	@{$$activities{None}} = ((grep{$_ ne $class} @{$$activities{None}}), $class);
+	$session->config->set('workflowActivities', $activities);
+}
+
 # ---- DO NOT EDIT BELOW THIS LINE ----
 
 #-------------------------------------------------
diff --git a/lib/WebGUI/Auth/WebGUI.pm b/lib/WebGUI/Auth/WebGUI.pm
index 8f566280f..76290efd6 100644
--- a/lib/WebGUI/Auth/WebGUI.pm
+++ b/lib/WebGUI/Auth/WebGUI.pm
@@ -758,10 +758,11 @@ sub resetExpiredPasswordSave {
 #-------------------------------------------------------------------
 sub validateEmail {
 	my $self = shift;
-	my ($userId) = $self->session->db->quickArray("select userId from authentication where fieldData=".$self->session->db->quote($self->session->form->process("key"))." and fieldName='emailValidationKey' and authMethod='WebGUI'");
+	my ($userId) = $self->session->db->quickArray("select userId from authentication where fieldData=? and fieldName='emailValidationKey' and authMethod='WebGUI'", [$self->session->form->process("key")]);
 	if (defined $userId) {
 		my $u = WebGUI::User->new($self->session,$userId);
 		$u->status("Active");
+		$self->session->db->write("DELETE FROM authentication WHERE userId = ? AND fieldName = 'emailValidationKey'");
 	}
 	return $self->displayLogin;
 }
diff --git a/lib/WebGUI/Workflow/Activity/ExpireUnvalidatedEmailUsers.pm b/lib/WebGUI/Workflow/Activity/ExpireUnvalidatedEmailUsers.pm
new file mode 100644
index 000000000..9ccf00796
--- /dev/null
+++ b/lib/WebGUI/Workflow/Activity/ExpireUnvalidatedEmailUsers.pm
@@ -0,0 +1,92 @@
+package WebGUI::Workflow::Activity::ExpireUnvalidatedEmailUsers;
+
+
+=head1 LEGAL
+
+ -------------------------------------------------------------------
+  WebGUI is Copyright 2001-2006 Plain Black Corporation.
+ -------------------------------------------------------------------
+  Please read the legal notices (docs/legal.txt) and the license
+  (docs/license.txt) that came with this distribution before using
+  this software.
+ -------------------------------------------------------------------
+  http://www.plainblack.com                     info@plainblack.com
+ -------------------------------------------------------------------
+
+=cut
+
+use strict;
+use base 'WebGUI::Workflow::Activity';
+
+=head1 NAME
+
+Package WebGUI::Workflow::Activity::ExpireUnvalidatedEmailUsers
+
+=head1 DESCRIPTION
+
+Deletes users who are inactive for more than a period of time due to
+not having validated their email addresses.
+
+=head1 SYNOPSIS
+
+See WebGUI::Workflow::Activity for details on how to use any activity.
+
+=head1 METHODS
+
+These methods are available from this class:
+
+=cut
+
+
+#-------------------------------------------------------------------
+
+=head2 definition ( session, definition )
+
+See WebGUI::Workflow::Activity::defintion() for details.
+
+=cut 
+
+sub definition {
+	my $class = shift;
+	my $session = shift;
+	my $definition = shift;
+	my $i18n = WebGUI::International->new($session, "Workflow_Activity_ExpireUnvalidatedEmailUsers");
+	push(@{$definition}, {
+		name => $i18n->get('activityName'),
+		properties => {
+			interval => {
+				fieldType => "interval",
+				label => $i18n->get('interval label'),
+				defaultValue => 86400,
+				hoverHelp => $i18n->get('interval hoverHelp'),
+			},
+		    }
+		});
+	return $class->SUPER::definition($session,$definition);
+}
+
+
+#-------------------------------------------------------------------
+
+=head2 execute ( [ object ] )
+
+See WebGUI::Workflow::Activity::execute() for details.
+
+=cut
+
+sub execute {
+	my $self = shift;
+	unless ($self->session->setting->get('webguiValidateEmail')) {
+		# Do nothing.
+		return $self->COMPLETE;
+	}
+
+	my @userIds = $self->session->db->buildArray("SELECT a.userId FROM authentication AS a INNER JOIN users AS u ON a.userId = u.userId WHERE a.authMethod = 'WebGUI' AND a.fieldName = 'emailValidationKey' AND u.status = 'Deactivated' AND u.dateCreated < ?", [$self->session->datetime->time - $self->get('interval')]);
+	foreach my $userId (@userIds) {
+		WebGUI::User->new($self->session, $userId)->delete;
+	}
+
+	return $self->COMPLETE;
+}
+
+1;
diff --git a/lib/WebGUI/i18n/English/Workflow_Activity_ExpireUnvalidatedEmailUsers.pm b/lib/WebGUI/i18n/English/Workflow_Activity_ExpireUnvalidatedEmailUsers.pm
new file mode 100644
index 000000000..5e5c0ad44
--- /dev/null
+++ b/lib/WebGUI/i18n/English/Workflow_Activity_ExpireUnvalidatedEmailUsers.pm
@@ -0,0 +1,21 @@
+package WebGUI::i18n::English::Workflow_Activity_ExpireUnvalidatedEmailUsers;
+
+our $I18N = {
+	'activityName' => {
+		message => q|Expire Unvalidated Email Users|,
+		context => q|The name of this workflow activity.|,
+		lastUpdated => 1165406607,
+	},
+
+	'interval hoverHelp' => {
+		message => q|How long a user must remain with their email address unvalidated before they are deleted.|,
+		lastUpdated => 1165406607,
+	},
+
+	'interval label' => {
+		message => q|Expiry Time|,
+		lastUpdated => 1165406607,
+	},
+};
+
+1;