i suppose that if you add an extra field in the table called authorise and then on the login page only log them in if their authorise is set to 1 in the db, you can set it to one by in the member.php file or whatever you add a thingy where when they get the email you get sent one asking you to either go to member.php?id=4&authorise=1 to let them log on
in the member.php you just have:
if (($GET['authorise']==1) && ($GET['id'])) {
$sql = mysql_query("UPDATE authorise FROM $membertable WHERE id = '$_GET['id']' ");
}
naturally theres more to it than that, making sure that the user thats authorising it is an admin and stuff like that,
hope you get an idea to a solution