Could you ask them to add a simple message to their home directory via
ssh thus proving they have access to the account?
Google do something similar, asking customers to add a randomly
generated subdomain to the dns records.
Steve
Show replies by date