How can Cloudflare determine the owner of a website?

Assume that we have two websites with two different owners. Both of them set their domain name server to and The first owner set both domains in his account in Cloudflare and set server IP to his server IP, How can Cloudflare determine that this person is not the owner of the second domain?

Isn’t this kind of a threat of our domain being hijacked by someone else?

When a user is signing up to Cloudflare they are provided with 2 of our DNS servers to switch their nameservers to from whatever their current value is. We have more nameservers than john and joly. The act of changing the nameservers to those specified for the user account signing up a domain to the values during the setup process demonstrates control of the domain.