I got this idea from a friend who said that he had got his hands on the WOTLK alpha client, where you can logon from your retail account but not on any characters.
Anyway, i was thinking you could maybe use this to help on Phishing scams, saying that they get the client and once they give thier account name and pass you will allow thier account to logon..I havnt tried it yet but..Just thought i'd suggest it.