Just having an account with an email address is enough.

They assign a subdomain automatically for uploads, same as cloudflare workers.

I don't know what they do, but implementing guardrails for this is possible nowadays with AI, but maybe they use a "mechanical turk"