As pbarnes_1 said, I'd recommend adding some form of authentication. Perhaps you can instruct the service to send the requester instructions to provide proof that they are the owner of the account.