You mean in the booking example? They logged in the browser that... requested access. So basically anyone that knew your login/email.

I think it should check if browser requesting is the same as the one confirming, or just drop that whole dumb mechanism entirely.