Two accounts can register with the same email address

Email is how support, billing, and any future "forgot your password" flow identify an account. If two different people (or one person twice, by accident) can register with the same email, there is no way to know which account an email-based action -- a password reset, a notification, a support lookup -- is supposed to act on. This is exactly the kind of gap that looks harmless until the first support ticket titled "I reset my password but I still can't log in to MY account" shows up, because the reset silently touched the wrong one of two accounts sharing an email.

RegisterSerializer validates password (via Django's password validators) but has no validation on email at all. Django's AbstractUser.email field (which accounts.models.User inherits) is not unique by default, so nothing at the database or serializer level stops a second POST /api/auth/register/ from reusing an email that already belongs to another account.

The ticket test registers the same email twice and asserts the second attempt should

return 400:

curl -s -X POST http://127.0.0.1:8000/api/auth/register/
-H 'Content-Type: application/json'
-d '{"username":"frank","email":"shared@example.com","password":"a-strong-password-123"}'

-> 201

curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"georgia","email":"","password":"another-strong-pw-1"}'

This has to be enforced in the serializer (or the database), not "by convention," because nothing else in the request path checks it -- create() just calls User.objects.create_user(**validated_data), which doesn't care whether the email is already taken.

Look at how DRF's CharField/EmailField support per-field validate_<fieldname> methods -- there's already a working example of a serializer-level validate() override to model the style on, in LoginSerializer right below RegisterSerializer in the same file, though that one validates the whole payload rather than a single field. You'll need to look up whether an account with that email already exists.