Help - Found critical issue where players can assign vehicles to other people's IDs

I'm working on a custom vehicle management system and just discovered a serious problem. Players are somehow managing to set vehicle ownership to other people's citizen IDs when purchasing cars. I can see in the database logs that the owner field is getting populated with completely different citizen IDs than who's actually buying the vehicle.

The event is structured like this:

RegisterServerEvent('qb-vehicleshop:setVehicleOwner')
AddEventHandler('qb-vehicleshop:setVehicleOwner', function(owner, plate)
-- PROBLEMATIC: Accepting owner directly from client
MySQL.update('UPDATE player_vehicles SET owner = ? WHERE plate = ?', {owner, plate})
end)

I'm seeing multiple reports of people finding random vehicles in their garages that they never bought, and the vehicle shop logs show someone else's citizen ID being passed as the owner parameter. This is happening across our entire playerbase and I need to figure out how they're manipulating this before more damage is done.

Anyone seen similar issues with client-side parameter manipulation in QBCore? I thought server events were protected from this kind of tampering but clearly I'm missing something.