Steven, if you are sending the e-mail via the interface, there is nothing you can do. One would argue that your current approach is the most correct one, as you are effectively testing the proper e-mail is being sent too.

In any case, you can always send the e-mail manually, which gives you access to the token. For recoverable, here is what you would call: https://github.com/plataformatec/devise/blob/master/lib/devise/models/recoverable.rb#L47

For now, I’ve resorted to extracting the “raw” tokens out of the sent emails. Is there a better way to do this? https://gist.github.com/stevenharman/6227508

It depends on how he can access the confirmation e-mail. If he can access the target inbox, then surely. As well if he’s sniffing the target network. In those cases, there is nothing we can do. Now, in case he was mistakenly sent a confirmation e-mail (for example, reconfirmable), there is nothing he can do.