Even if it‘s by design that you can share a page, you shouldn‘t be able to change account data should you? And it sounds like the author didn‘t share their page and it was still accessible.

MW made a video: https://youtu.be/ILcjmnFCID8