3rd party can update incident that is forwarded to them

Content

Hi,

Let's say we have an incident belonging to a contact called Charlie White that I forward to an external/private email such as [email protected]

We have set up our interface so that you have to be a contact within the system in order to update requests. However, when Jo replies, the incident is not only updated but it looks as though Jo Bloggs has updated it.

Why is this happening? This is causing massive issue as it looks like the contact is approving whatever is said in the incident and of course, they aren't actually them