A user's lightning address is set in their profile, which is a signed kind 0 event. A proper nostr client will validate signatures of all events received ignoring those that don't check out.
Login to reply
Thread
Zero-JS Hypermedia Browser