This is the email bomb protocol. This person creates a ton of accounts at different Fediverse servers and probably other applications, using the same email address on each, so the owner of the email gets pounded with emails. This is to cover up or make it impossible for the person to see that their bank account or whatever has been compromised and to prevent recovery.

Eventually the email provider protects itself by rate limiting the incoming emails so they aren’t even seen. This causes the SMTP servers to continue trying to send the emails due to the temporary failure, generating even more email.

Ultimately the email provider will shut down the email address, and that poor person cannot see any of the emails sent by the bank with warnings or account instructions, and it certainly delays recovery until all the assets are removed from the account.

You should close registrations or at least require approval.

I don’t know how it works on Peertube, but on Mastodon, the email validation is sent even if approvals are required, so it doesn’t stop the bombing.

You can check your logs for some way to recognize the incoming requests and set up a firewall rule if you have access to a firewall that can do this.