Like you said, you could have admins approve new users to authenticate them. I find it cumbersome and don't do it, but it may be necessary with a system like this. Or maybe set up an option where only new users who have sponsors have to be authenticated/approved by an admin, but not users who don't have a sponsor.
