Great question - we verify that the user owns the e-mail address by verifying they have access to it - essentially when we e-mail them a link they have to click to get access to the document on HelloSign. We also log their IP address and browser, it may seem like a low bar but we feel it's inherently more secure than in real life where people fax documents to shared machines and mail items to shared/unsecured addresses. For Google Accounts, we trust Google to verify they own the e-mail address via OpenID.

For our standalone product @ http://www.hellosign.com you can also add a second layer of authentication by using a signer PIN that you can set and send to the signer via a different method (phone call, text message, alternate e-mail address).