diff --git a/src/test/common.js b/src/test/common.js
index be2286984..77b7092f5 100644
--- a/src/test/common.js
+++ b/src/test/common.js
@@ -208,5 +208,9 @@ function clearMailQueue() {
 async function checkMails(number) {
     await delay(1000);
     expect(mailer._mailQueue.length).to.equal(number);
+    const emails = mailer._mailQueue;
     clearMailQueue();
+
+    // return for further investigation
+    return emails;
 }
diff --git a/src/test/users-test.js b/src/test/users-test.js
index 071ec5d6c..7283b6f5d 100644
--- a/src/test/users-test.js
+++ b/src/test/users-test.js
@@ -493,11 +493,37 @@ describe('User', function () {
     describe('invite', function () {
         before(createOwner);
 
-        it('send invite', async function () {
+        let user;
+
+        it('get link fails as alreayd been used', async function () {
+            const [error] = await safe(users.getInviteLink(admin, auditSource));
+            expect(error.reason).to.be(BoxError.BAD_STATE);
+        });
+
+        it('can get link', async function () {
+            const userId = await users.add('some@mail.com', { username: 'someoneinvited', displayName: 'some one', password: 'unsafe1234' }, auditSource);
+            user = await users.get(userId);
+
+            const inviteLink = await users.getInviteLink(user, auditSource);
+            expect(inviteLink).to.be.a('string');
+            expect(inviteLink).to.contain(user.inviteToken);
+        });
+
+        it('cannot send mail for already active user', async function () {
+            const [error] = await safe(users.sendInviteEmail(admin, 'admin@mail.com', auditSource));
+            expect(error.reason).to.be(BoxError.BAD_STATE);
+        });
+
+        it('cannot send mail with empty receipient', async function () {
+            const [error] = await safe(users.sendInviteEmail(user, '', auditSource));
+            expect(error.reason).to.be(BoxError.BAD_FIELD);
+        });
+
+        it('can send mail', async function () {
             await clearMailQueue();
-            const inviteLink = await users.sendInvite(admin, {}, auditSource);
-            expect(inviteLink).to.be.ok();
-            await checkMails(1);
+            await users.sendInviteEmail(user, 'custom@mail.com', auditSource);
+            const emails = await checkMails(1);
+            expect(emails[0].to).to.equal('custom@mail.com');
         });
     });
 
diff --git a/src/users.js b/src/users.js
index d9cfcea92..7b3ba473b 100644
--- a/src/users.js
+++ b/src/users.js
@@ -659,6 +659,9 @@ async function sendPasswordResetEmail(user, email, auditSource) {
     assert.strictEqual(typeof email, 'string');
     assert.strictEqual(typeof auditSource, 'object');
 
+    const error = validateEmail(email);
+    if (error) throw error;
+
     const resetLink = await getPasswordResetLink(user, auditSource);
     await mailer.passwordReset(user, email, resetLink);
 }
@@ -767,6 +770,10 @@ async function sendInviteEmail(user, email, auditSource) {
     assert.strictEqual(typeof user, 'object');
     assert.strictEqual(typeof email, 'string');
     assert.strictEqual(typeof auditSource, 'object');
+
+    const error = validateEmail(email);
+    if (error) throw error;
+
     const inviteLink = await getInviteLink(user, auditSource);
     await mailer.sendInvite(user, null /* invitor */, email, inviteLink);
 }