 <p>I would go with "from" + confirmation, to avoid forging.</p> <p>I.e. receive the email, but send a response with auth token in the subject line (or in the body) back to the "from" address. The user either will need reply, or click a link to confirm the submission.</p> <p>And you post the content only after confirmation.</p>