Now verifying the originator against the currently logged in user,

instead of the owner of the outbox.