require active account to own domain

backend/multimail/owner.py

@@ -12,5 +12,7 @@ def user_from_request(request):
 
 
 def may_own_domain(user):
+    if not user.is_authenticated or not user.is_active:
+        return False
     u = classify_user(user)
     return u["source"] == "system" or u["source"] == "ldap"