a quick, simple (hopefully temporary) solution would be to have them submit some sort of password with the email (not the same one they use to log in). it isn'

a quick, simple (hopefully temporary) solution would be to have them submit some sort of password with the email (not the same one they use to log in). it isn't very secure, but its a level or two of security higher than what you're creating now without any protections.