Turns out "anyone can edit" also meant anyone could mess with the sharing settings. So I've made it read only, which is a pity. Will investigate alternative hosting arrangements that might support pull requests at some point...