You know, we can ignore case in some cases, like “forgotten password” or “login” when there is no clash.
If there is only 1 sam@somewhere in the system and no Sam@somewhere in the system we can be somewhat forgiving, keep in mind if the email was activated we already know the one stored in the table is good and this is not a real security threat.
