I'd think this could be prevented by a) stop giving out order numbers via chat and b) require customers to request replacements (or at least confirm them as you've suggested) by logging into their account.