Function check 

pub async fn check(
    session: &Session,
    rate_limit: &dyn RateLimit,
    submitted: &str,
) -> Result<CheckOutcome, OperationOutcomeError>

A correct code consumes the pending entry and marks the address verified.

Every guess spends one point of a shared MAX_ATTEMPTS budget before the code is compared, so a code can be compared at most MAX_ATTEMPTS times however many requests run at once. The budget is counted in rate_limit with [RateLimit::check_uncached], which serializes concurrent spends in the database; a counter kept in the session would be lost under a burst, because each request holds its own copy. The key is the code’s salted hash, so a fresh code (a resend) starts over, and the key is never guessable or shared between addresses.