We do verify the request is legit, but yes, same as anyone can hire a pen test, this is all on public endpoints and chances are people are already running them, companies just don't know about it.