Mechanisms exist to reject unauthenticated, or untrustworthy, disclosure requests.
Does the organization reject unauthenticated, or untrustworthy, disclosure requests?