Two step mail list sign ons are standard practice, no you don't need to buy a script.
Here's what I do.
A user downloads my software and I ask if they want to be on my list.
I use email_validation to check that the email checks out
I save the email address and a "pending" status into a table with an auto-id. I retrieve the id.
I then email an html email to the user saying you have to click the link to confirm. The link includes the id and points to a script which grabs the id, updates the table with a "checked" status.
Then I can run a cron job, call my admin page etc to clear out all the email addresses which are "pending" and stale - more than X days old.
How to handle the bounces?
Currently I give my support email address and handle the bounces manually. I don't get any from that mailer but I might from subsequent mailers.
I plan to get a blind pop3 account which is never linked to a desktop email client. Instead I'd look through this list (http://sarah.users.phpclasses.org/browse.html/class/2.html) for a script which I can use/adapt to get the bounces and grab the email.
We just did a big mailer for a client and didn't do this, we got a 10% fail rate (only 1300 sent) and haven't culled them this time. Next time we'll use this technique and then pull the emails back into the CRM system afterwards.