So, the link sent to the mail should be used privately. Based on that link, if the user did any review actions or created discussions, then this will be updated in the name of the invited user only.
Thank you for your patience.
We have investigated your concern with our team, and they have informed us that it is an expected flow of behaviour.
We would like to provide you with more detailed information about the flow.
1. When a user (who is already in the environment) is invited for a review, the user will receive the email, and the URL used to invite that user is specifically generated for that user alone. That's why, when the URL is used, in the profile, the username is shown.
Also, clicking on that URL when a discussion is started or an item is set, reviewed, or approved falls under that username itself, as the URL is generated specifically for that user. So, the user strictly must not share his email with other users.
2. When a user (who is not part of the environment) is invited for a review using the Invite Collaborators option. When a user receives the email using that specific invite URL, he will be asked to register himself first to become a registered user in the environment. If the user declines to perform this registration, then he will be an invited collaborator in the invited collaborators list.
If you have any other questions, please feel free to reach out to us.
Reference
Ticket ID: #9824
Subject: Prolaborate Short URL Review Security Issue
Department: Prolaborate Support
URL: https://desk.zoho.com/agent/sixthforcesolutions/prolaborate-support/tickets/details/759413000036328170.