An artifact is verified by its reference and the email address it was issued to. The address is never stored or shown; it is checked against the record and discarded.