Users should be required to confirm their phone number or email address

[Colin Powell]

This will require adding an "active" field to subscriptions that will default to False.

Then, once the user clicks the confirm link, the subscription is set to active=True. Of course, the notification sending script should skip inactive subscriptions.