We get most of our clients to do e-signatures. It's instigated by an email address, i.e. the "link" to sign it is sent to the email address previously used for communication etc, so that's the first "check". The e-signing system itself is password protected, so again, that means it can only be accessed by the person we've been dealing with by email as that's how the password and access to the system is first instigated. Once e-signed, we get a "ping" of the ip address, device type, browser type, date and time, confirmation of email used to access the system, etc. So, it's not just a random e-signature, it's "parcelled up" in a package of other data, and based around the email address and password protection.
We'd never do it with an email address that we hadn't previously used for communication with the client, and mostly, we've received most of the information/scanned documents, etc from that same email address, so there'd be plenty of evidence that we were dealing with the same person who'd sent us the information to compile the documents in the first place.
Of course, if someone hacks into their email system, and somehow managed to guess/find their password, they can access and e-sign the document, but that can happen with "wet" signatures if someone intercepts mail, forges a signature and submits it! There's not a central database of wet signatures, so HMRC don't check "wet" signatures on paper documents either. (In reality, banks don't routinely check "wet" signatures on cheques etc either).