They have to state under penalty of perjury that they're authorized to act on behalf of the owner of some relevant right. While that might not necessarily involve the right to the Ubuntu ISO itself (e.g. they might have pattern-matched something else that they're acting on behalf of) they do need some good cover story to avoid perjuring themselves.