When a signer opens the link, we email a 6 digit code to the same address. They type it in to continue. The code is valid for 10 minutes, and after five wrong tries a new one is needed. This proves at the moment of signing that the person signing controls the email address you invited.