Check for that "Update" activity and it's "object" are from same origin
The receiving server MUST take care to be sure that the Update is authorized to modify its object. At minimum, this may be done by ensuring that the Update and its object are of same origin. https://www.w3.org/TR/activitypub/#update-activity-inbox