Someone photographed our table QR and 'ordered' from home as a prank — risk?

A table order placed from home still lands on your board with the table name — staff glance, see table 7 empty, cancel with reason. Codes can also be rotated by retiring/re-adding a table if one leaks badly.