We are sending emails to contacts, using Civimail, with a link to a webform. These contacts do not have a login to Civi so are seen by the webform as 'Anonymous (not verified)' users when they are submitted. However, those contacts are able to forward these emails to others, who are not contacts in Civi, who can then click on the link and complete the webform. When these unauthorised people do that, the webform sees them as the person who forwarded the email to them (because of the contact id in the link). Other than giving the original contacts a signin to Civi, is there a way of preventing this? This is a Drupal 7 site, Civi is at 5.35.2
That's one of the problems with checksum links - it's just a link connected to a specific user and although you sent the link to the specified contact, there is no guarantee that it is actually that person using it. The options come down to hoping people read your instructions and answer correctly.
You can ask people not to forward the mail ("Please don't forward this mail - it contains links to your personal data" ...) or either of the approaches Pete describes.
Another potential approach for webforms which I've used (in both Drupal 7 and Backdrop), is to adjust settings on the "Existing Contact" webform component for that contact.
In the "Contact Field Handling" section, you can configure it to lock the Contact Fields, Email, etc. if they contain data, leaving them open for editing if they are empty.
In this way, if it's attached to an existing contact by a checksum the person will not be able to change the name/email data so it's very clear who they are filling the form for. But if they come to the form with no checksum and no pre-filled info, it's just a regular empty form.
EDIT: Regarding a contact reference field that is set up as autocomplete:
The first name and last name field will be "lockable", but the autocomplete contact reference does allow a user to remove the default selection and make a new selection. So they can see who they are filling the form out for (and potentially select a different contact) but not change the first/last name (or any locked info) of the existing contacts.