Spend an invite: set a name and a password, and sign in.

Signs them straight into the portal rather than bouncing to the login form, for the same reason /hs/signup/verify does: the username was derived from their organization's name and they have never seen it, so "now enter your username" would strand every single person this letter reaches.

Single use is enforced by the store, which clears the hash in the same statement that writes the password. A second visit to the link therefore finds nothing, which is the correct answer: the account now has an owner.