Notes app can be tricked into using a received share created before the user logged in

None...