Throwaway account created for the check

This check is the only one that leaves a trace: a row in `auth.users`. The scan cannot remove it itself — that would require the service_role key, and using it would be exactly the mistake it is looking for. So it names the address instead of hiding it.

That is why this stage runs only after domain verification. Against your own domain a test account is defensible; against someone else's it never would be — regardless of how useful the result might be.

Nothing is read in the process: rows are only counted via `HEAD` with `Range: 0-0`. The scan learns how many foreign records the account could see, not which ones.