I am launching a new site soon and in my previous experience I know many bots will create accounts, I'm trying to avoid this so before a user can sign in they need to verify their email address. If they email address doesn't get verified within X amount of time should I automatically remove the account? What's best practice in this area?
To add to Stephen's comment, it's unlikely that absolutely nothing goes into any database at the point of unverified account creation. Therefore, the question is what you want to do with the information you do have. Leaving the inactive info in there indefinitely will not do any immediate harm, but it will create noise in your data and add unnecessary weight to your tables.
If the user's email and whatever other information is saved somewhere, but the user doesn't take the final step to verify, you may want to send a reminder email the next day. You may want to follow up in a week or so with a second reminder, as people get busy, forget, or procrastinate.
If they don't verify after a couple of weeks, I'd delete the info to keep your data tables clean. You can play with the timeframes in which you do all this, but that's the general approach I'd recommend.