This question asks it (presumably for Drupal 7), but the solutions all appear to be specific to D7 and not applicable in D8, so that's effectively a different question.
It appears that hook_ENTITY_TYPE_presave() could be used used, but what checks would need to be done to check that it's the user confirmation (password added)?