You could make it single-use tokens and rate limit individual users when they request too many tokens in a short time. Someone could still share their tokens with a friend, but it doesn’t scale to where thousands are verifying with some stranger’s id.