Problem definition :

If a domain is claimed for an organization ex: demo.com and there are managed users under this organization, any random user on the internet can visit Atlassian.com and sign up with an account ex: abc@demo.com this will add the user to the managed account list of org which has demo.com verified with "unverified" label. Org admins need to manually verify if the accounts are legitimate accounts that are yet to verify or if its a random user on the internet 

Suggested Solution::
Accounts that are not verified should not be under Managed accounts list

Workaround: 

No workaround is available at this moment