Clarify rule for removing unconfirmed

Problem/Motivation

It’s not obvious how and when (if ever) unconfirmed subscribers are removed from the database.
Spambots can generate hundreds and thousands of unconfirmed subscribers entries on the database.
How long will these remain there before they are deleted?

Steps to reproduce

Expose alpha-2 to large volume of subscribers including those emanating from spambots