Activation string in Access_user class

Someone registered to my site with someone else's mail.
I asked a younger collegue who is in touch with hackers, how could it be possible and he asked me how was the activation code formed. He guessed on the second answer!
The activation code should contain the time of registration including microtime or a secret code string valid for the site or both.

EDIT: changed the subject before someone get scared :)

what you're saying is not true just check the code and you will see that the activation code is based on something else.