I generate a 10 digit random number, store it in the database, and also build it into a URL which I then send to the user (i.e. http://domain.com/verify.php?email=foo@bar.com&verification=01234556789).
The user then follows this hyperlink, a script verifies the verification number matches that which I have on record for their address, and changes a flag from inactive to active on their record in my database. Simple.
HTH, Andy.