The server only accepts metadata from the owner. But of course anyone can publish events claiming to own any repository in the world.