Allowing email from a stranger because I trust them. How?

Yes. And they don’t even need to have an account at all. That’s what the "staged user"stuff is about.