> what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user?

This would require compromising the website as a whole