Yeah, that’s what I thought. Was going to try to avoid user accounts but I agree that could be dangerous.
Originally I was using gravity forms to do this form (which allows non-logged in users to upload) but it unfortunately doesn’t integrate the Plupload functionality which I wanted.
Time to rethink what I need to do. Thanks!