Ok there are a few ways this might happen, particularly if you've deliberately bypassed validations. But you're not an idiot. You haven't done that. If you're using devise this might be your answer...
- Are you using the "confirmable" feature that requires a user has to confirm their email address?
- Did you ever directly use the method it makes available on the model named
There's your trouble!
Devise has a horrible horrible default on that method to ignore validations and force save.
Do this instead