What happens if an unauthorized/third party responds to the ticket via email?

BoldDesk validates whether the replied user is related to the ticket or not; if not, it will be updated as a private note; the agent will validate and mark it as public if he wishes.