Ah, right, so they can't just publish a zap receipt from a different node then? (Which then you would have to double check with your node?)
Discussion
They can’t because the zapper pubkey is set in your lnurl endpoint and clients check that (if they implement the spec properly)
I guess that means clients aren't implementing the spec fully because I've seen it on zaplife fake zaps going out to others (not just to the person fake zapping).. like the 21 million Bitcoin zap lol.