I hope that the email only initiates the transfer and that the approval takes place either in the Square Register app or on their website.
How do they authenticate the other guy to get his money out ? all you have is his email address. What do they do, hope someone can't see the auth-code you send him via email?
In any event, I'm curious to find out more about their abuse prevention.