[jaywalk]

Took me a second to wrap my head around what you were saying, so I'll point it out: they'd be pointing their CDN account to your origin server, and making requests through it.

[judge2020]

Same for Cloudflare - to mitigate this your server should only respond to the correct HOST header for your website.