What happens if a user never verifies their email or phone number?
An unverified contact reserves the identifier for 10 minutes after the last verification code was sent. After that it goes stale, and another user can claim the same email or phone number by registering with it — the stale entry is removed from the original account.
Until someone else actually claims it, the original user can still recover: signing in with a one-time code or completing a password reset verifies the contact and ends its staleness.